Edit tour

Windows Analysis Report
pdhmXuEYmc.exe

Overview

General Information

Sample name:	pdhmXuEYmc.exe renamed because original name is a hash value
Original sample name:	085f06b14ffef066d5a8acc5995e82f0.exe
Analysis ID:	1430200
MD5:	085f06b14ffef066d5a8acc5995e82f0
SHA1:	42afb72c4f5d73b7af151d90e59de9cc235e87b5
SHA256:	92afa7a9c3f0dceaaba64f46bee7623f43c94fa04dc56c8704f9f82f2054e453
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

pdhmXuEYmc.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\pdhmXuEYmc.exe" MD5: 085F06B14FFEF066D5A8ACC5995E82F0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["91.92.241.122:39361"], "Authorization Header": "bdcad13ad9ecf2711ee0a5378c208b99"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
pdhmXuEYmc.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1690619448.0000000000842000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: pdhmXuEYmc.exe PID: 7432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pdhmXuEYmc.exe PID: 7432	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.pdhmXuEYmc.exe.840000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 91.92.241.122

Timestamp:	04/23/24-09:58:16.446515
SID:	2043231
Source Port:	49730
Destination Port:	39361
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 91.92.241.122 - Destination IP: 192.168.2.4

Timestamp:	04/23/24-09:58:10.121851
SID:	2046056
Source Port:	39361
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 91.92.241.122

Timestamp:	04/23/24-09:58:04.686159
SID:	2046045
Source Port:	49730
Destination Port:	39361
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 91.92.241.122 - Destination IP: 192.168.2.4

Timestamp:	04/23/24-09:58:04.883476
SID:	2043234
Source Port:	39361
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: pdhmXuEYmc.exe

Malware Configuration Extractor: RedLine {"C2 url": ["91.92.241.122:39361"], "Authorization Header": "bdcad13ad9ecf2711ee0a5378c208b99"}

Multi AV Scanner detection for submitted file

Source: pdhmXuEYmc.exe	Virustotal: Detection: 59%			Perma Link
Source: pdhmXuEYmc.exe	ReversingLabs: Detection: 68%

Source: pdhmXuEYmc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pdhmXuEYmc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 4x nop then jmp 0699C213h	0_2_0699BF50
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	0_2_06992E88
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 4x nop then jmp 0699E515h	0_2_0699E4F4
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 4x nop then jmp 0699A8BBh	0_2_0699A8A3

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 91.92.241.122:39361
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 91.92.241.122:39361
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 91.92.241.122:39361 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 91.92.241.122:39361 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.92.241.122:39361

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 91.92.241.122:39361

Source: Joe Sandbox View

ASN Name: THEZONEBG THEZONEBG

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.241.122

Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EFC000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002F20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002F20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: pdhmXuEYmc.exe	String found in binary or memory: https://api.ip.sb/ip
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File created: C:\Users\user\AppData\Local\Temp\TmpAA73.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File created: C:\Users\user\AppData\Local\Temp\TmpAA84.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_02B9DC74	0_2_02B9DC74
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_05136948	0_2_05136948
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_05137C20	0_2_05137C20
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_05130006	0_2_05130006
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_05130040	0_2_05130040
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_05137C10	0_2_05137C10
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0634A6B8	0_2_0634A6B8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_063467D8	0_2_063467D8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06343F50	0_2_06343F50
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0634A688	0_2_0634A688
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06346FF8	0_2_06346FF8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06346FE8	0_2_06346FE8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699AF80	0_2_0699AF80
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06999FB8	0_2_06999FB8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699BF50	0_2_0699BF50
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06996C68	0_2_06996C68
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06998DA8	0_2_06998DA8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699E5A8	0_2_0699E5A8
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699CDE5	0_2_0699CDE5
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06999210	0_2_06999210
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06996398	0_2_06996398
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_069913C0	0_2_069913C0
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699D838	0_2_0699D838
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06999850	0_2_06999850
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699CE3D	0_2_0699CE3D
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06998D99	0_2_06998D99
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699E598	0_2_0699E598
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06999200	0_2_06999200
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_069913B0	0_2_069913B0
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06996050	0_2_06996050
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699F078	0_2_0699F078

Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1832359941.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\000004B0\\OriginalFilename vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\040904B0\\OriginalFilename vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\080904B0\\OriginalFilename vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe, 00000000.00000000.1690645418.0000000000886000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEigenvalue.exe8 vs pdhmXuEYmc.exe
Source: pdhmXuEYmc.exe	Binary or memory string: OriginalFilenameEigenvalue.exe8 vs pdhmXuEYmc.exe

Source: pdhmXuEYmc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

File created: C:\Users\user\AppData\Local\Temp\TmpAA73.tmp

Jump to behavior

Source: pdhmXuEYmc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: pdhmXuEYmc.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pdhmXuEYmc.exe	Virustotal: Detection: 59%
Source: pdhmXuEYmc.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: pdhmXuEYmc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pdhmXuEYmc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: pdhmXuEYmc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: pdhmXuEYmc.exe

Static PE information: 0xA4A130BF [Tue Jul 10 21:46:39 2057 UTC]

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06331DAF push FFFFFF8Bh; retf	0_2_06331DB1
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0634EFB2 push eax; ret	0_2_0634EFC1
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_06343B4F push dword ptr [esp+ecx*2-75h]; ret	0_2_06343B53
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_063449AB push FFFFFF8Bh; retf	0_2_063449AD
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Code function: 0_2_0699FF30 push es; ret	0_2_0699FF40

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Window / User API: threadDelayed 463			Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Window / User API: threadDelayed 3415			Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe TID: 7596	Thread sleep time: -10145709240540247s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: pdhmXuEYmc.exe, 00000000.00000002.1832491424.0000000000E65000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll|

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Code function: 0_2_06997DB0 LdrInitializeThunk,

0_2_06997DB0

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Users\user\Desktop\pdhmXuEYmc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: pdhmXuEYmc.exe, 00000000.00000002.1832491424.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1858687880.000000000643D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: pdhmXuEYmc.exe, type: SAMPLE
Source: Yara match	File source: 0.0.pdhmXuEYmc.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1690619448.0000000000842000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdhmXuEYmc.exe PID: 7432, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\pdhmXuEYmc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdhmXuEYmc.exe PID: 7432, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: pdhmXuEYmc.exe, type: SAMPLE
Source: Yara match	File source: 0.0.pdhmXuEYmc.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1690619448.0000000000842000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdhmXuEYmc.exe PID: 7432, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pdhmXuEYmc.exe	59%	Virustotal		Browse
pdhmXuEYmc.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.RedLine

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	1%	Virustotal		Browse
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	1%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002F20000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	pdhmXuEYmc.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000328D000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003253000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.000000000315F000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000003127000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EFC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EFC000.00000004.00000800.00020000.00000000.sdmp, pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	pdhmXuEYmc.exe, 00000000.00000002.1835216796.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.92.241.122	unknown	Bulgaria		34368	THEZONEBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430200
Start date and time:	2024-04-23 09:57:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pdhmXuEYmc.exe renamed because original name is a hash value
Original Sample Name:	085f06b14ffef066d5a8acc5995e82f0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 118 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:58:13	API Interceptor	18x Sleep call for process: pdhmXuEYmc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	Remittance slip.js	Get hash	malicious	VjW0rm	Browse	91.92.255.130
	PROFOMA INVOICE.js	Get hash	malicious	VjW0rm	Browse	91.92.255.61
	zirurEg4mX.elf	Get hash	malicious	Unknown	Browse	91.92.252.191
	qBSw7aeXEM.exe	Get hash	malicious	RedLine	Browse	91.92.250.88
	cXiIHv7tfd.exe	Get hash	malicious	Lokibot	Browse	91.92.253.228
	wQkjhw6VZ6.elf	Get hash	malicious	Gafgyt	Browse	91.92.245.31
	MFj7OCV6NX.elf	Get hash	malicious	Gafgyt	Browse	91.92.245.31
	YQKtul13uu.exe	Get hash	malicious	Lokibot	Browse	91.92.253.228
	hNqGyuEhv2.elf	Get hash	malicious	Gafgyt	Browse	91.92.245.31
	z4LHgT1E0T.elf	Get hash	malicious	Gafgyt	Browse	91.92.245.31

Process:	C:\Users\user\Desktop\pdhmXuEYmc.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:34 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4578669622154754
Encrypted:	false
SSDEEP:	48:8SzdGTi+7RYrnvPdAKRkdAGdAKRFdAKR/U:8Ss4
MD5:	E4DAE0C93C6B19289C2C4D7ED156370F
SHA1:	6F83C89ECF56AD3F21112E56DFEF5A3A0CE35B0E
SHA-256:	34E1D0F53212A15AED0CF5078CE1A586A02A3DFC2BE82337E4DC4C2C66DE81FC
SHA-512:	9BC9727EC3D50387068216C8195D8B91871EAA906054B44B13251183F22E181BBBC204F9FCC4580E40A632AD344F1D92715F17B51FB22AB97B2DD5BBC8081281
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,...............q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWR`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWR`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWR`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWJ`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdhmXuEYmc.exe.log

Download File

Process:	C:\Users\user\Desktop\pdhmXuEYmc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpAA73.tmp

Download File

Process:	C:\Users\user\Desktop\pdhmXuEYmc.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpAA84.tmp

Download File

Process:	C:\Users\user\Desktop\pdhmXuEYmc.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\pdhmXuEYmc.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.083790498934454
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	pdhmXuEYmc.exe
File size:	311'296 bytes
MD5:	085f06b14ffef066d5a8acc5995e82f0
SHA1:	42afb72c4f5d73b7af151d90e59de9cc235e87b5
SHA256:	92afa7a9c3f0dceaaba64f46bee7623f43c94fa04dc56c8704f9f82f2054e453
SHA512:	dafee8b090d3c6449ab0b41dabbb9d5c421f2e0e5f72ea6d7eba5ade2f69124c1f6c204dbb40e022db9b5071e2fd84cafaefef5d15261975d1a6dce53af49def
SSDEEP:	3072:gq6EgY6i2rUjeLTeHwP+ChTQ4E1WPSmbTAwtASiSkcZqf7D34FeqiOLibBO9:jqY6i4MwPXT5EIS6TAsAskcZqf7DIPL
TLSH:	95646C1823988511E27F4F7994B1E2749379EC5AA453E30F4EC06CEB3E32751FA15AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42ba1a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA4A130BF [Tue Jul 10 21:46:39 2057 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007FA9D0D24992h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007FA9D0D24992h
jnc 00007FA9D0D24992h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007FA9D0D24992h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007FA9D0D24992h
je 00007FA9D0D24992h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007FA9D0D24992h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007FA9D0D24992h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b9c8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b9ac	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2ea00	0x2ec00	90926859c184d78274759c9e04689776	False	0.46997723094919786	data	6.2082932015233405	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9d4	0x1cc00	157480f3cce6afdf7fe2c21d4ef7ee88	False	0.23727921195652174	data	2.606370261495621	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	918dfa7ddca38ac1d86ff1880cd96e08	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x35a	data	0.44405594405594406
RT_MANIFEST	0x4e7e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-09:58:16.446515	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	39361	192.168.2.4	91.92.241.122
04/23/24-09:58:10.121851	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	39361	49730	91.92.241.122	192.168.2.4
04/23/24-09:58:04.686159	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	39361	192.168.2.4	91.92.241.122
04/23/24-09:58:04.883476	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	39361	49730	91.92.241.122	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 09:58:04.240636110 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:04.438736916 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:04.438998938 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:04.447880983 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:04.644844055 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:04.686158895 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:04.883476019 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:04.932457924 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:09.920500994 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:10.121850967 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:10.121911049 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:10.121947050 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:10.121973038 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:10.121987104 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:10.122037888 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:10.318172932 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:10.369932890 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:10.486229897 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:10.684355974 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:10.729306936 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:10.845674992 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:11.042951107 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.048603058 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:11.246642113 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.250334978 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:11.447627068 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.457156897 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:11.654607058 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.661683083 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:11.858113050 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.858212948 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.858910084 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:11.860753059 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:12.058099985 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:12.064344883 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:12.261615038 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:12.262852907 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:12.459815979 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:12.510596037 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:12.529385090 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:12.743592024 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:12.791798115 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:12.907479048 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.103861094 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.103903055 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.103936911 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.104033947 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.104154110 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.104204893 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.104290962 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.105292082 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.151176929 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.202888012 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.399538994 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399594069 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399629116 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399653912 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.399658918 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399691105 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399766922 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399775028 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.399775982 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.399800062 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399831057 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.399857044 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.399887085 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.400094032 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400145054 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400190115 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.400224924 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400284052 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.400336981 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400367975 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400423050 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.400438070 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400494099 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.400587082 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.400645971 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.596504927 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.596558094 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.596590042 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.596821070 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.596869946 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.596900940 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.596930981 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597121000 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597186089 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.597242117 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597332954 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.597371101 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597604990 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597693920 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597803116 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597832918 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.597903013 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598010063 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598092079 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598121881 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598191977 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598237991 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598306894 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598433971 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598464012 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598572969 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598642111 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598710060 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.598779917 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.793180943 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.793598890 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.793687105 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.793787956 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.793865919 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.793956041 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.793977022 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.794078112 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.794466019 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.794617891 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.794768095 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.794876099 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.794949055 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795022964 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795099020 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795212030 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795243025 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795392990 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795775890 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.795804977 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.796030998 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.796264887 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.796372890 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.990509987 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.990576029 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.990609884 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.990669012 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.990727901 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.990854025 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991082907 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991132021 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991235971 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991331100 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991494894 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991535902 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991585016 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991679907 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991724968 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991880894 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.991978884 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992074013 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992120981 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992259026 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992352009 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992449999 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992481947 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992665052 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992734909 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992867947 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.992898941 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993006945 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.993052959 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993128061 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993146896 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.993158102 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993352890 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993458033 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993529081 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993573904 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993748903 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.993856907 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994062901 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994091988 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994163036 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994338989 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994369030 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994463921 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994518995 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994587898 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994827032 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:13.994854927 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:13.994930029 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.189512968 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.189567089 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.189811945 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.189966917 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.190129995 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.190438986 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.190470934 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.190880060 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191070080 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191099882 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191210032 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191245079 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191276073 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191400051 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191442013 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191570044 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191654921 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191822052 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.191853046 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192075968 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.192184925 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192204952 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.192312956 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192343950 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192440987 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192471981 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192543983 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192653894 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.192687988 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193372011 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193403006 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193433046 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193463087 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193492889 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193522930 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193552017 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193581104 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193610907 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193640947 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193670988 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193700075 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193733931 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193764925 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.193835974 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.194000006 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.194112062 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.388892889 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.388943911 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389206886 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389312029 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389342070 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389528036 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389723063 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389761925 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.389792919 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.390204906 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.390435934 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.390716076 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.390746117 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.390965939 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.390996933 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391241074 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391411066 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391442060 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391552925 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391815901 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391845942 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.391874075 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.392016888 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.392247915 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.392512083 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.392596006 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.392626047 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.392941952 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.393013000 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.393433094 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.393462896 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.393493891 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.393954992 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.394112110 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.588537931 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.588591099 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589010000 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589044094 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589073896 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589189053 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589225054 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589315891 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589346886 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589780092 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589884043 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.589962006 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590087891 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590292931 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590419054 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590534925 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590646982 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590677023 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590707064 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590773106 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.590919971 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.591048956 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.591237068 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.591355085 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.591510057 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.591609001 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.591681957 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.594156027 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:14.651173115 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:14.993078947 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:15.189771891 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:15.190819979 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:15.194303036 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:15.391547918 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:15.413219929 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:15.610611916 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:15.614181042 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:15.812352896 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:15.814353943 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:16.011462927 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:16.051064014 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:16.248413086 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:16.248790026 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:16.445765972 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:16.446515083 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:16.647413015 CEST	39361	49730	91.92.241.122	192.168.2.4
Apr 23, 2024 09:58:16.692440987 CEST	49730	39361	192.168.2.4	91.92.241.122
Apr 23, 2024 09:58:16.698944092 CEST	49730	39361	192.168.2.4	91.92.241.122

Target ID:	0
Start time:	09:58:01
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\pdhmXuEYmc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pdhmXuEYmc.exe"
Imagebase:	0x840000
File size:	311'296 bytes
MD5 hash:	085F06B14FFEF066D5A8ACC5995E82F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1690619448.0000000000842000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1835216796.0000000002D78000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	148
Total number of Limit Nodes:	7

Executed Functions

Function 0699D838 Relevance: 3.3, Strings: 2, Instructions: 766
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+7vgCt5YN94CoaZ39L1ZtHnTa0z+N149Eamj1mVWephHZ6kRHjalH28uP86Qv1HBEWaP1Xp0Xh/wBkgj1KFF8WxIdTx8WeKnNwzgiugp/bDxQaZQbuvZZUw4Fb5qMd, xrefs: 0699D957, 0699DD82, 0699E1D5
@B/, xrefs: 0699DB5F

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: +7vgCt5YN94CoaZ39L1ZtHnTa0z+N149Eamj1mVWephHZ6kRHjalH28uP86Qv1HBEWaP1Xp0Xh/wBkgj1KFF8WxIdTx8WeKnNwzgiugp/bDxQaZQbuvZZUw4Fb5qMd$@B/
API String ID: 0-2191481496
Opcode ID: c49245505f4e08fedcc587042520b9b8871ba1daa834fedc4619b8a392dafab0
Instruction ID: c812efe8bb62a0f88bf7aba918d2a75345dcda6da33a40472dde48aff0a0de0c
Opcode Fuzzy Hash: c49245505f4e08fedcc587042520b9b8871ba1daa834fedc4619b8a392dafab0
Instruction Fuzzy Hash: 5B829A74E012288FDBA4DF69C994BDDBBB2BF89301F1085EAD409A7650DB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0699BF50 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 0699C243
LRdq, xrefs: 0699C00A

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: LRdq$PHdq
API String ID: 0-3514635139
Opcode ID: d4fcdbe4ed231ace3a7601682b79a2e2ba7ad48dd9e7069c4b5bbbddb2bcd9a9
Instruction ID: 3bc765cb222a2ed0e6317bcbc9bfe23b85f7722378442e167a1f9fa94681f0b7
Opcode Fuzzy Hash: d4fcdbe4ed231ace3a7601682b79a2e2ba7ad48dd9e7069c4b5bbbddb2bcd9a9
Instruction Fuzzy Hash: FAA1D274E00218CFDB64DFA9C954B9EBBB2FF89300F2094A9D409AB765DB305A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06343F50 Relevance: 1.8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 063441E4

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: 0d0a1a2040c24047fd791009ea810159d3e73848105412ff15e16fbbfdc6cb52
Instruction ID: 128377635fd93bd77bfc45354176d50a61185f5a649cd335f1f3b3c8bd8545bc
Opcode Fuzzy Hash: 0d0a1a2040c24047fd791009ea810159d3e73848105412ff15e16fbbfdc6cb52
Instruction Fuzzy Hash: 6E124C74B002158FCB54DF69C594AAEBBF6FF88710B158569E806EB366DB30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06997DB0 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06997E15

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 54e7554fb005df89ac02ebb4d9b42d441b7d65785ca52cfa4271e4be358d9aab
Instruction ID: 11570ea7ceee153ed33a343ad280067c444ce0d2a7c38aacf8f35e02e535593f
Opcode Fuzzy Hash: 54e7554fb005df89ac02ebb4d9b42d441b7d65785ca52cfa4271e4be358d9aab
Instruction Fuzzy Hash: 76219274E112189FCF44DFA9E884AEDBBB6AB89310F10946AE415B7360DB305841CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06996398 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VWj, xrefs: 0699664F

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: \VWj
API String ID: 0-2419293905
Opcode ID: becc7723d13a3c268e0260b9e458bbefc17d899fe6f9e49106c2e2dd90c74710
Instruction ID: bf495a014055b91a6a44e3e4f1704a17f3aff8d628776b4bba65af06d4e0d912
Opcode Fuzzy Hash: becc7723d13a3c268e0260b9e458bbefc17d899fe6f9e49106c2e2dd90c74710
Instruction Fuzzy Hash: 97B17C70E002098FEF54CFADC99579DBBF6AF88304F248529D815EB694EB349841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0699CDE5 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

,f, xrefs: 0699D157

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: ,f
API String ID: 0-2825746204
Opcode ID: 328c660ce059bbb65e48796645fb6af5b9dae9a44c5a921a93555a1f684391f2
Instruction ID: 7e3002b985b13c93f63d4b3047283ceb87091a288cea297c66f2867c410a92d8
Opcode Fuzzy Hash: 328c660ce059bbb65e48796645fb6af5b9dae9a44c5a921a93555a1f684391f2
Instruction Fuzzy Hash: C6B1B374E01228CFDB64DF69C990B9DBBB2BF89300F5085AAD809AB355DB315E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 063467D8 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1521d070f71d7e64aa64d70c8af24bbf90713bdce5af12d1593e1d124b731034
Instruction ID: d110811104b0e982629eba3b76ac9e7ee76a3e5731d1c36b9cb361d861e3bc11
Opcode Fuzzy Hash: 1521d070f71d7e64aa64d70c8af24bbf90713bdce5af12d1593e1d124b731034
Instruction Fuzzy Hash: 9612C171A002199FCB51EF68D881B9EBBF2FF86310F158569E509DB261DB30ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06999FB8 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd82f9f3f8714a2f1c89428680d4c8d61a3aded61c952715ef0160c538951bd
Instruction ID: 8dcf0ea2c5dc7ae9899f48677b17d07c1e8a13e60cf491441d749fe484dfa341
Opcode Fuzzy Hash: afd82f9f3f8714a2f1c89428680d4c8d61a3aded61c952715ef0160c538951bd
Instruction Fuzzy Hash: 6D429D74E012288FDBA4DF69C954BEEBBB2BF89300F1095E9D50AA7250DB315E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05136948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858067786.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d18adf504b3a8f4ed65c54b7dfd2cb23ef7ac5058aeff95ada62f76a4577427
Instruction ID: cedb45b8a92cfeb9ac1d0964e5c26c3967001428f3282c0521522fe6752c08b2
Opcode Fuzzy Hash: 8d18adf504b3a8f4ed65c54b7dfd2cb23ef7ac5058aeff95ada62f76a4577427
Instruction Fuzzy Hash: 4022F174A01228DFCB65DF64C954BE9BBB2FF4A310F0090E9E509A72A1DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069913B0 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145506951062ca90416977ac6d147418c3cf20af15b3f71ce8156e7d097cc527
Instruction ID: 2d05edc4f3840ac4503f86b8612779f9860f01d51aed13e9cc21f2d730184bbc
Opcode Fuzzy Hash: 145506951062ca90416977ac6d147418c3cf20af15b3f71ce8156e7d097cc527
Instruction Fuzzy Hash: 51E13C74E003099FDB88DBB4C895AAEBBF6EF88311F404018E51ABB795CE345D81DB65

Uniqueness

Uniqueness Score: -1.00%

Function 069913C0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f10fc39ce48f1c3ed2ab782a6d0364132cb4dbb70b1dc5f3a1e949dd85f7aac
Instruction ID: 88247ee6e403eefdb120051c41aeb44f17f6e2ff3095afec0aa99a1c3d5f91fa
Opcode Fuzzy Hash: 8f10fc39ce48f1c3ed2ab782a6d0364132cb4dbb70b1dc5f3a1e949dd85f7aac
Instruction Fuzzy Hash: 4AE12B70E003099FDB88DBB4C895AAEBBF6EF88311F404018E51ABB795CE345D81DB65

Uniqueness

Uniqueness Score: -1.00%

Function 06999210 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6263b756c2865c67311d1f1303b565ba931f9ee367682f48b2e2165ba1c92e21
Instruction ID: d2cad987c06b14e8ef5640591a8265aea11f15eee5ecd02847574fa5b0b0bcee
Opcode Fuzzy Hash: 6263b756c2865c67311d1f1303b565ba931f9ee367682f48b2e2165ba1c92e21
Instruction Fuzzy Hash: E7F19274A01228CFDB68DF64C950B9EBBB2BF89300F2085E9D509AB364DB315E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0699E5A8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddbc3b78822bf5a60ca220caaaad41fe5f8541ffb4e3b1ca67d24fbc3a52c79a
Instruction ID: 17356020d25e982c87e159bc1a1c0f86727da609201dcf6d967fa746fa14e363
Opcode Fuzzy Hash: ddbc3b78822bf5a60ca220caaaad41fe5f8541ffb4e3b1ca67d24fbc3a52c79a
Instruction Fuzzy Hash: 9BE1C074E01229CFDB64DFA9C950B9EBBB2BF89300F1091AAD409B7255DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0699AF80 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f918ec405e5b5922f693dbe45632b29d0c2b7ee3a37a186457b3e9d1e114ad96
Instruction ID: 379bb37c8f76b6e7289ea3f074415d626d7fe6443ae93a0a52fab046a1589f7f
Opcode Fuzzy Hash: f918ec405e5b5922f693dbe45632b29d0c2b7ee3a37a186457b3e9d1e114ad96
Instruction Fuzzy Hash: 05D1A074E01218CFDBA4DFA9D984B9EBBB2BF89300F2081AAD409A7355DB345D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0634A688 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457fcbe3551bb4a8ab996e563b24275ef11c3ecba2e1182b2a8165b399e813e5
Instruction ID: b5d15ebae2ae4e4c24120060bf5f45cf8db132a4de3a4e4c72038604cd02a1bf
Opcode Fuzzy Hash: 457fcbe3551bb4a8ab996e563b24275ef11c3ecba2e1182b2a8165b399e813e5
Instruction Fuzzy Hash: 7DD10574A00218CFCB54EFB4D8546ADBBB2FF8A301F1082A9D44AAB354DB396985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0634A6B8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f91bab05d69be27f1b0f5110668dc10bbee1ee03b9a223443a16acd4a355bb
Instruction ID: 45dfbfc88ff51fbf560b5ae22445d9104d60c51d73f2012804a7773adc77036e
Opcode Fuzzy Hash: 14f91bab05d69be27f1b0f5110668dc10bbee1ee03b9a223443a16acd4a355bb
Instruction Fuzzy Hash: 28D1F670A00218CFCB54EFB4D8546ADBBB2FF8A301F1082A9D44AAB354DF396985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06998DA8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94659ea4b09a8968dff46ed61657d01eb0bf8ab5ae136ce1dc3a6d4ea3dedcc4
Instruction ID: c87740bb21979e85d1664c08e42054648dc5614961152508b3202c6832803bd2
Opcode Fuzzy Hash: 94659ea4b09a8968dff46ed61657d01eb0bf8ab5ae136ce1dc3a6d4ea3dedcc4
Instruction Fuzzy Hash: 34D1AD74E01218CFDB64DFA9C984B9DBBF2BF89300F2495A9D509AB355DB309A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05137C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858067786.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef3625e6c25d937d84ea56c48e99ecc573d4af263eb7e898b7377da6faa7590
Instruction ID: eea0b30242aacc30a0677c5970d882c1c3b7f340760216a1664d89b3e4c0e46d
Opcode Fuzzy Hash: cef3625e6c25d937d84ea56c48e99ecc573d4af263eb7e898b7377da6faa7590
Instruction Fuzzy Hash: 59C1C2B4E01218CFDB14DFA9C990A9DBBB2FF89300F14C1A9D419AB355DB309A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06999850 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a6149a184f650d2ce3a38c237d9bf0e61347bef28ac0d43612bf24ec139c3a
Instruction ID: 0c59afa4079285e9175e704ffcd66d3539c4c3ca0c5969a866ae7fce26a20e2e
Opcode Fuzzy Hash: 12a6149a184f650d2ce3a38c237d9bf0e61347bef28ac0d43612bf24ec139c3a
Instruction Fuzzy Hash: C1C1C370D012298FDB68DF69C950BDEBBB2BF89300F1485EAD409AB294DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06996C68 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c49bcbba09ef7e70a7805f719dca9569e88b295b3e56985af4144498e78dc12
Instruction ID: c6272fbd500fe1e4b591de22af4c40d8508a0275e275c9364804d6f98a6a5dd0
Opcode Fuzzy Hash: 4c49bcbba09ef7e70a7805f719dca9569e88b295b3e56985af4144498e78dc12
Instruction Fuzzy Hash: 2CB18E70E002098FEF54CFACD8857ADBBF6AF88314F248529D419E7794EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06999200 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddca55601c68a1f09e97399c744514623ddfb8fbfb99c788eb9cdbea21dbf7dc
Instruction ID: b9af380a5671f440dc474dbd3e0615c33890033bdf8e16ec6aecbcc32ee5086e
Opcode Fuzzy Hash: ddca55601c68a1f09e97399c744514623ddfb8fbfb99c788eb9cdbea21dbf7dc
Instruction Fuzzy Hash: E2A1D774E01228DFEB64DFA5C850B9EBBB2FF89300F2081A9D509AB255DB315E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05137C10 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858067786.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e5fcb0c42634e2a0a81b46cbf1c986603039e2eacd437c6a0ca26eab932937
Instruction ID: 34e40512aca152266e85d477536a26e4430d78e1c8f56814065e229a556bb6f9
Opcode Fuzzy Hash: 78e5fcb0c42634e2a0a81b46cbf1c986603039e2eacd437c6a0ca26eab932937
Instruction Fuzzy Hash: 0251C574E002188BEB18DFAAD85179EFBB3BF88300F14C0A9951DAB259DB3459859F50

Uniqueness

Uniqueness Score: -1.00%

Function 0699CE3D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff32b922d89d1c9be397ab2565b0b33f48258d6ea056674d7cef14cc628ff4d2
Instruction ID: 36b5131ea83c26015b71dcf33c5c115507bd5eff1a0095e6c21f1d87c6ab46e7
Opcode Fuzzy Hash: ff32b922d89d1c9be397ab2565b0b33f48258d6ea056674d7cef14cc628ff4d2
Instruction Fuzzy Hash: B2411971D016189BEB69CFBAC8507DEBBB7AFC9300F14C06AD819AB655DB700946CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06330D80 Relevance: 20.6, Strings: 16, Instructions: 621
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06331461
$dq, xrefs: 06330FB8
$dq, xrefs: 06330E84
$dq, xrefs: 06330FAC
$dq, xrefs: 06331336
$dq, xrefs: 06331455
$dq, xrefs: 06330E02
$dq, xrefs: 063313EB
$dq, xrefs: 06330E52
$dq, xrefs: 06331430
$dq, xrefs: 06330F86
$dq, xrefs: 0633137B
$dq, xrefs: 063313AC
$dq, xrefs: 063313A0
$dq, xrefs: 06330E78
$dq, xrefs: 06330F36

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-256639137
Opcode ID: 591bfaf15242b3953ea54b7bb5a3a782d3fcc683f448effe25f620563df7d8b6
Instruction ID: b4370a61e2632b6bd0c16d81de6faab72c96b05986afa470352b8194290e509c
Opcode Fuzzy Hash: 591bfaf15242b3953ea54b7bb5a3a782d3fcc683f448effe25f620563df7d8b6
Instruction Fuzzy Hash: 05329F30B042159FDB59DBA9C844A6ABBFAFF89300B158469E506CB7A2CF74DC05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06331582 Relevance: 7.8, Strings: 6, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 0633182E
$dq, xrefs: 06331A57
$dq, xrefs: 06331A12
$dq, xrefs: 06331A7C
$dq, xrefs: 06331A88
$dq, xrefs: 063318E3

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: e27bc809c37c6d29f354166b1793a7c43adc4e4851d990872b66fbbd5238f857
Instruction ID: 7e91339bde31e391e236eb05cd322ce317c6c4c21c3cabb2983beac9a30d8caf
Opcode Fuzzy Hash: e27bc809c37c6d29f354166b1793a7c43adc4e4851d990872b66fbbd5238f857
Instruction Fuzzy Hash: A3C1BF34B042249FDB54ABA8C854A2E7BEAEF89701F148869E503CB7A2DF74DC05C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 06348C88 Relevance: 2.6, Strings: 2, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(hq, xrefs: 06348D2C
(hq, xrefs: 06348D00

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: (hq$(hq
API String ID: 0-2483692461
Opcode ID: f6ff5d7bcb6474c781bf60216a3072ff9998d5462c24612b0c9fbefe89b000ef
Instruction ID: 9e2623d92803fa0eea56b9c1607b80fac097a74aec5c6c0011f47561209099d0
Opcode Fuzzy Hash: f6ff5d7bcb6474c781bf60216a3072ff9998d5462c24612b0c9fbefe89b000ef
Instruction Fuzzy Hash: 81412375B041585FCB45AF78981076F7BA2AFD5351F608469E909AB380CE38DD12C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 02B9AE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B9B086

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 33f57737f0af65895e00ffb616a86cadfa9e85c90159e02ccb38a7a3375a9f4c
Instruction ID: bc51dc9a89e7d4ea545a5dcb0418b01879099b29f2b566a3e5f1914a14f9b2dc
Opcode Fuzzy Hash: 33f57737f0af65895e00ffb616a86cadfa9e85c90159e02ccb38a7a3375a9f4c
Instruction Fuzzy Hash: B27147B0A00B058FDB24DF29D48579ABBF5FF88304F10896DE48AD7A40DB75E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06997BDD Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06997D28

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f216675585476a672d957b0be254ea10db690ab88e3f42751e5941948653d63d
Instruction ID: ec94def2dc35a57be41b4d43aade54ff14923e0029bf06068c5f02cd64534110
Opcode Fuzzy Hash: f216675585476a672d957b0be254ea10db690ab88e3f42751e5941948653d63d
Instruction Fuzzy Hash: 1E51C574E112089FDF48EFA9D5506ADBBB6FF89300F109429E405AB758DB345942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05130BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05134381

Memory Dump Source

Source File: 00000000.00000002.1858067786.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_pdhmXuEYmc.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5abbe0fb58bf3bbe26c2ba2df690b77df20fb702b5dc57572f8e94ff77c21c72
Instruction ID: 42b8be2f85dc079af04d1984d01fbe6f09187ff4ee8b26c2fce580571a4896a5
Opcode Fuzzy Hash: 5abbe0fb58bf3bbe26c2ba2df690b77df20fb702b5dc57572f8e94ff77c21c72
Instruction Fuzzy Hash: 594128B49003158FDB14DF99C889EAEBBF5FF88314F258499D519A7321D774A841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B94248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02B959F1

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d17a8d31c2bae0eb08e37258887e459aacffa16ca9198e2f685c3c8388c0c7fd
Instruction ID: 6568830b7dba024b0747c15eaf0c5250eb3c98ba127f1d6483c2258c72cc623b
Opcode Fuzzy Hash: d17a8d31c2bae0eb08e37258887e459aacffa16ca9198e2f685c3c8388c0c7fd
Instruction Fuzzy Hash: 2F41E0B0C0071DCBDB24DFA9C884B9DBBB5FF49314F6080AAD409AB251DBB56949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02B95935 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02B959F1

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 51c166b65d751cdc7cd3eb1b3beae018661eea6a19c688166db6e36aa70b65fe
Instruction ID: 35110a062a2a9a8f6bdfadd6c05869ed9fd1343b73587e8a283f266ed5a0db98
Opcode Fuzzy Hash: 51c166b65d751cdc7cd3eb1b3beae018661eea6a19c688166db6e36aa70b65fe
Instruction Fuzzy Hash: 1D41E0B0C00719CADB24DFA9C884ADEBBB5FF49304F2080AAD419AB251DB756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06997C52 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06997D28

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8a72b4d6d5d5eb11b590fe3782b7abe9b5199f1ce7b4d31abd651e76792fa962
Instruction ID: cb7ed69e69f629d33cb7bb658f496f9441f34bfce1d4e380e238556ee07da1d5
Opcode Fuzzy Hash: 8a72b4d6d5d5eb11b590fe3782b7abe9b5199f1ce7b4d31abd651e76792fa962
Instruction Fuzzy Hash: C93193B4E112089FCB44EFE4D590AADBBB2FF88300F205529D416AB758DB345D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02B9A858 Relevance: 1.6, APIs: 1, Instructions: 81libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B9B101,00000800,00000000,00000000), ref: 02B9B312

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08aa94b24ae5187c051c9c942c512e9ce2c831d49aad94193c851169b4d05849
Instruction ID: 22426fca539df644fc1ad4121dc1e72b427fd2a3f831e8605c40a3d8cbc83292
Opcode Fuzzy Hash: 08aa94b24ae5187c051c9c942c512e9ce2c831d49aad94193c851169b4d05849
Instruction Fuzzy Hash: 8331BDB68083488FDB01DFAAD894ADEBFF0EF5A314F0180AAD459A7242C3749505CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02B9C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B9D2C6,?,?,?,?,?), ref: 02B9D387

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d6307b58c09c741f0c0aece05c746af5a045900b6efbb7b991925af9ece32c3b
Instruction ID: 88f08feb7798046523d2e4b3edbcc3bbf48d411083eb7519b593b26ab8200a96
Opcode Fuzzy Hash: d6307b58c09c741f0c0aece05c746af5a045900b6efbb7b991925af9ece32c3b
Instruction Fuzzy Hash: CC21E4B5900309EFDB10DFAAD984ADEBBF4EB49310F14846AE918A3351D374A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02B9D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B9D2C6,?,?,?,?,?), ref: 02B9D387

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 539f384b2069443b404acdad2fe88f93bbcea8d93093f91472de8c05bae0de8c
Instruction ID: 1034992fcd4284eb33d7241bf5fb8462bac71708e69ac9a1eff25012d142e27a
Opcode Fuzzy Hash: 539f384b2069443b404acdad2fe88f93bbcea8d93093f91472de8c05bae0de8c
Instruction Fuzzy Hash: 3921E2B5D00249DFDB10CFAAD984ADEBBF5EB48314F14845AE918B3350D374AA54CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02B9A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B9B101,00000800,00000000,00000000), ref: 02B9B312

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7c92ef91e4bf24cce9b54c9b308fcce62522ac90a177b0345c487dff8fbb0ace
Instruction ID: 05d98f37877cac4d51ccd1f6ac491c8e4c01a5dd90d8536487d9bfa7c0509f81
Opcode Fuzzy Hash: 7c92ef91e4bf24cce9b54c9b308fcce62522ac90a177b0345c487dff8fbb0ace
Instruction Fuzzy Hash: EF1126B6D003498FDB10DF9AD444ADEFBF4EB48314F10846ED559A7201C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02B9B2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B9B101,00000800,00000000,00000000), ref: 02B9B312

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ef27c0aa0b13328802e0efb96f4870d7b14d353e29ddb7e3a4e0b400d8eca5ec
Instruction ID: acc260fe526e95bb16c296a5d47a18cf8587d129d26367c7fab48f24ff8c5c88
Opcode Fuzzy Hash: ef27c0aa0b13328802e0efb96f4870d7b14d353e29ddb7e3a4e0b400d8eca5ec
Instruction Fuzzy Hash: 341126B69003498FCB10CF9AD444ADEFFF4EB49324F14846EE569A7200C375A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B9B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B9B086

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e4fdabfebc94c6df648e7aa7dba348fee16e8fbdd5ae28e4096337a9b31d763b
Instruction ID: 0d5ea08737036ed963b0d2205e54b09bf9ca73beb8cd6964c65b65c6b7cf9eef
Opcode Fuzzy Hash: e4fdabfebc94c6df648e7aa7dba348fee16e8fbdd5ae28e4096337a9b31d763b
Instruction Fuzzy Hash: F91110B6C007498FCB20DF9AD444ADEFBF4EB89328F10846AD429B7210C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06993A8C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06997B5D

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cd54d6250b79386184344247ed48749bcf8e1acdb058ad57ca21d64ae3eeb02b
Instruction ID: 6343c7ac6579397653ce8d73e7d6f17c7c9e6571408cc7d181622f0a26fb1b20
Opcode Fuzzy Hash: cd54d6250b79386184344247ed48749bcf8e1acdb058ad57ca21d64ae3eeb02b
Instruction Fuzzy Hash: 131145B18007489FCB20DF9AD488BDEFBF8EB48320F208459D519A7600C774A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06343DE0 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06343F25

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: cc1f58a58132ee8b2d76c44dfb1cab5980e09e94b2d7e51f101d9f680262bd99
Instruction ID: cd53dc41c3c2bfb0a08552199e09e8b5713a0e9932dcbe975b12c9be299dc3f8
Opcode Fuzzy Hash: cc1f58a58132ee8b2d76c44dfb1cab5980e09e94b2d7e51f101d9f680262bd99
Instruction Fuzzy Hash: EB31F3727007504FC719A778E8A069EBBE6EFCA31175548AEE4098B741DE30EC438BA1

Uniqueness

Uniqueness Score: -1.00%

Function 063484D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'dq, xrefs: 063485B1

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 62b6db8ba77044f14a076460b84c28ba3e43d8d93b6b7eeb96034bccf4c4516b
Instruction ID: 785aaf6419d9676ea77c14051e9826bd49abe0fb3b91a9a3f93c9ffb5587775b
Opcode Fuzzy Hash: 62b6db8ba77044f14a076460b84c28ba3e43d8d93b6b7eeb96034bccf4c4516b
Instruction Fuzzy Hash: 94319F30B002048BDB09BB78A49056F77E7AFC8211B50843DD60BCB385EE31DE0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 063484C8 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4'dq, xrefs: 063485B1

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: efe61d7756cb3a321ec9c41f1e568cda0b9ccb8650cc33379289c267a728c999
Instruction ID: aba6503cba9c45531997e1b7334ed757275996216ae2e1454b6c842c48f9b619
Opcode Fuzzy Hash: efe61d7756cb3a321ec9c41f1e568cda0b9ccb8650cc33379289c267a728c999
Instruction Fuzzy Hash: EB217C70B102058BDB09BB78A4A467F7AE7AFC8211B54447DD50BDB385EE34DE0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 0634B628 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

4'dq, xrefs: 0634B669

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: bdcd0e7e9491734b2cc4f8c6fc7d12859e4ac20fc3d84fa5dd7b43c3649a7947
Instruction ID: 7346a5997b71a265ccbc425ea75fd6377e5efc7699723c17d16349a7e0eaff38
Opcode Fuzzy Hash: bdcd0e7e9491734b2cc4f8c6fc7d12859e4ac20fc3d84fa5dd7b43c3649a7947
Instruction Fuzzy Hash: 79019A34A02244DFCB01EBB8E55459C7FF1FB89201B2810AEE40AEB266DB301E44CB00

Uniqueness

Uniqueness Score: -1.00%

Function 06343EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06343F25

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: f4edc73e361bf72ee30c26aa6fc5539ce8460ba8d94e66b02b7340efdbe15fd4
Instruction ID: c46d1a795fa1a3d9e42b00095599aaae210d3378d2d66a779970859a90da8f93
Opcode Fuzzy Hash: f4edc73e361bf72ee30c26aa6fc5539ce8460ba8d94e66b02b7340efdbe15fd4
Instruction Fuzzy Hash: 7BF0F6313002014BC208EB68E85156E37DBEBC8351350482DE00D8B304EF30AD4687E1

Uniqueness

Uniqueness Score: -1.00%

Function 0634B638 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'dq, xrefs: 0634B669

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: c8e85fbe6b79e3b368dcbc3b25d2d1723e3e8cc24ee9f1e21c0d2947401516a5
Instruction ID: fd90e4a13211ad6d9ac9e343a7f9c2c1a843a5e78812737b606cef2a7c04f145
Opcode Fuzzy Hash: c8e85fbe6b79e3b368dcbc3b25d2d1723e3e8cc24ee9f1e21c0d2947401516a5
Instruction Fuzzy Hash: ABF06470A02209AFCB04EFB8E54569CBBF1FB88201B2465ADE80AA7655EB301F458B44

Uniqueness

Uniqueness Score: -1.00%

Function 06332078 Relevance: 1.0, Instructions: 1039COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e725ee1973094e0c1869a520e6e5c0eab8d0b21df9141194e9209f9ff01f6c7
Instruction ID: 479a1782e4359effea258072dc646feb04f3d9d63f10ca2ec18fd1e314d0039e
Opcode Fuzzy Hash: 7e725ee1973094e0c1869a520e6e5c0eab8d0b21df9141194e9209f9ff01f6c7
Instruction Fuzzy Hash: 97924170B002189FCB559F64CC51BAEBBB6EF88700F118499E50AAB3A1DF719E41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 06333933 Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe92c6fe181423435ceccd1b7a2a7b100e0644b01c70eee43e4972b5b42457b
Instruction ID: 66bc2438a4823ce8a99b8d28fbdc9ee45b29288e2e6a58f4e07307234736b297
Opcode Fuzzy Hash: ebe92c6fe181423435ceccd1b7a2a7b100e0644b01c70eee43e4972b5b42457b
Instruction Fuzzy Hash: 41521974B002149FCB44DF68C895EAEBBF6FF89704F158099E506DB3A2DA71ED448B90

Uniqueness

Uniqueness Score: -1.00%

Function 063300D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed74df76edc33766f29cec3a15aae89dc04f4350181d062f097dd3566f8cadbd
Instruction ID: 23da7558a8a19fc5666781d2d09a1b0775811f736f899a112df6b1e83b4f7610
Opcode Fuzzy Hash: ed74df76edc33766f29cec3a15aae89dc04f4350181d062f097dd3566f8cadbd
Instruction Fuzzy Hash: 714267347006288FCB64AF78D45462EBBE2FFC5711B50499CE5039B395CF7AAE058B91

Uniqueness

Uniqueness Score: -1.00%

Function 06331F2A Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e0b87b44cafb3d958d5cdb856697c256d976d1b89399f61ddb177dc29c9016
Instruction ID: 2bc2663d9bc98f7e9d3a97ad599d12661c62ef2204e468fba112c552f1f3e060
Opcode Fuzzy Hash: 12e0b87b44cafb3d958d5cdb856697c256d976d1b89399f61ddb177dc29c9016
Instruction Fuzzy Hash: FD428474B002148FCB549F24C855EAEB7B6EF88704F118499E90A5F792CF71EE858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 063300B9 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e11bcb71f050f23625f805e1c5e6fa1707290687ace57bdb1f766c230bc38e
Instruction ID: d783f5bc755852aff60961430fc77cf428ff3e71f9df2e752a5a38abc23df132
Opcode Fuzzy Hash: 76e11bcb71f050f23625f805e1c5e6fa1707290687ace57bdb1f766c230bc38e
Instruction Fuzzy Hash: 72C16E34B103149FDB489B64C859B7E7BEAEF89704F108069E9028B7A1CB76DD45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06330666 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f5e1f89df9edde10d6d0d9ff2c92d63a1174d2cdc123e7ba0cf2d2a295c1c0
Instruction ID: cadd2c9f7c81a15b687c1bd8e39530e377b49b5f7a7a39dd7c9128b9243afa5c
Opcode Fuzzy Hash: 05f5e1f89df9edde10d6d0d9ff2c92d63a1174d2cdc123e7ba0cf2d2a295c1c0
Instruction Fuzzy Hash: B8B18C34B103149FDB489B64C859B3E7AEAEF89704F508055EA028B3A1CFB6DD45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 063306DE Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57ea7db5bc64c785fb2092fb5cb7f8f4ececf8e6027c14c61a910481078ca48
Instruction ID: 07f1d2167cd1d3b1df2c88becf3626dfdd169610c13b5e5ce6e2f70766b3ef90
Opcode Fuzzy Hash: e57ea7db5bc64c785fb2092fb5cb7f8f4ececf8e6027c14c61a910481078ca48
Instruction Fuzzy Hash: 28B18D34B103149FDB489B64C859B3E7AEAEF89704F508055EA028B3A1CFB6DD45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 063305EE Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa06b13c5e699235fa1d366817ef7f0f68ae16d326fa163a8ed2cddedff88c8c
Instruction ID: 9610a94df738c4aa1c7db5064d800a520e00efd3ad98f1c549c9a4f0753fcfe8
Opcode Fuzzy Hash: fa06b13c5e699235fa1d366817ef7f0f68ae16d326fa163a8ed2cddedff88c8c
Instruction Fuzzy Hash: 01B18D34B103149FDB489B64C859B3E7AEAEF89705F508055EA028B3A1CFB6DD45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06344AFF Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3913f7374e526564000928c4ea3a21df6450cf8f494e027a198d10f6becbe7d
Instruction ID: f09f91684b5417f804abe2ee59f426d1daf90d2130111cca5033e4f78f930027
Opcode Fuzzy Hash: d3913f7374e526564000928c4ea3a21df6450cf8f494e027a198d10f6becbe7d
Instruction Fuzzy Hash: 64C13978B006058FC744DF69C484AAAFBF6FF89301B1585A9E546DB366DB30EC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06347D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0dc51482d846dd88a1183086b12b6e8f40ca83ed259d1a491c124cb03d3803
Instruction ID: e0844f18336c43d20f782a276b1bad7719787c5579b9432a3725627e995b8050
Opcode Fuzzy Hash: fb0dc51482d846dd88a1183086b12b6e8f40ca83ed259d1a491c124cb03d3803
Instruction Fuzzy Hash: A4514771E10258DFDB54DFA9D980BDEFBF6AF48300F148529D415AB294DB74A846CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06347D4C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d4576c9df9d20ba8dd4b1a6834ca4e78b20d51d28a59e449578e40c01566e3
Instruction ID: 5161b630450faf5e34331a3e3748362fe6ebb6c0bfa0794331e369a634553905
Opcode Fuzzy Hash: 63d4576c9df9d20ba8dd4b1a6834ca4e78b20d51d28a59e449578e40c01566e3
Instruction Fuzzy Hash: C05158B1D10258DFDB64DFA9C984BDEFBF5AF48300F148529E415AB294DB74A886CF80

Uniqueness

Uniqueness Score: -1.00%

Function 063459C8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caeec487cda7e4dcb71988eee3277235dd002a5b0b2f40866a0391777f998a74
Instruction ID: 5c97c5d2a8c05b349f734976dabfd9c2f7e6ee803c4aa0671cb074d48e58f2f3
Opcode Fuzzy Hash: caeec487cda7e4dcb71988eee3277235dd002a5b0b2f40866a0391777f998a74
Instruction Fuzzy Hash: B2415879A00606CFCB51DF58C88096AFBF2FF88360B15C959E55ADB261D730F805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06345579 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19527e75f4589b2ba35200eb13000ccef9bb983556844fd2a8e4a67c03f04d83
Instruction ID: e31cfabe230b4af8b0a30d772561037fccb150e39eed4fb97ae953fdb000f8f0
Opcode Fuzzy Hash: 19527e75f4589b2ba35200eb13000ccef9bb983556844fd2a8e4a67c03f04d83
Instruction Fuzzy Hash: 093168B9B012109FCB05DF34D884A6EBBB6BF89341B508469E906CB355DB30ED15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06345588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd0da4f9d80826da37a9c9e2af97f6dfba8250aa44fd8e70080a5e42e74d894
Instruction ID: 8cbf1c9be54f230af3d8f63f272763001f91f1708a62049827bc52e1e18e8a37
Opcode Fuzzy Hash: 6dd0da4f9d80826da37a9c9e2af97f6dfba8250aa44fd8e70080a5e42e74d894
Instruction Fuzzy Hash: 98314479B012109FCB45EF38D88496EBBB6FF89341B508469E90ACB355DB30ED15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 063487A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08404ffc4623ce249ffb33c74a8e77ff3ab250b44ebe62cd02f228d313f246b3
Instruction ID: b24989423f01f7777664eb76616abf040a4430f2bff0d86123e40f72f782bef0
Opcode Fuzzy Hash: 08404ffc4623ce249ffb33c74a8e77ff3ab250b44ebe62cd02f228d313f246b3
Instruction Fuzzy Hash: C34112B1D01248DFDB14EFAAD940ADEFBF6AF88310F10802AE415B7254DB35A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0633309C Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa85b13903b65aef837a574c236c7462d43098f64b2959265136a0321288ed2
Instruction ID: 730dbce632844239d965d1c8d723a38a082f5928f04f4426fc866c1f73499739
Opcode Fuzzy Hash: bfa85b13903b65aef837a574c236c7462d43098f64b2959265136a0321288ed2
Instruction Fuzzy Hash: 29316F35B401149FDB54DF68D984EA9BBB1EF88314F12C0A4E9099F3A2CA31EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06348796 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75511099421018c07233b88e9d0ddfed0c88d3373892fc2dbd336b58697258fe
Instruction ID: f49f1818e56fe2eb50c8270be2fae83df424039adbb369688b6c1dbc2a18ae84
Opcode Fuzzy Hash: 75511099421018c07233b88e9d0ddfed0c88d3373892fc2dbd336b58697258fe
Instruction Fuzzy Hash: A33104B1D012489FDB14EFAAD944ADEFFF6AF48300F14802AE415B7290EB35A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0633360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c214f99e25e2b0fda45615c319f61fbd792ce5cd2f44f6dd4dac2ccbfce154
Instruction ID: 42c808b051e672f8ce19423a012e570643d73a95bb9112981ceaabe6c5d5a885
Opcode Fuzzy Hash: 21c214f99e25e2b0fda45615c319f61fbd792ce5cd2f44f6dd4dac2ccbfce154
Instruction Fuzzy Hash: DE216D36B404149FDB54DF69C884EAABBB2FF88714F1180A5F9099F3A6DA31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06348A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7637cbd28fdce7a61d1e320a0dcf2038758b0c6e7b3b0fe234f685336d7b8f
Instruction ID: 7c9b29f69ec9d69dd38c7b054ca7570c9be5b3cfed503098fad7b38c276cab65
Opcode Fuzzy Hash: df7637cbd28fdce7a61d1e320a0dcf2038758b0c6e7b3b0fe234f685336d7b8f
Instruction Fuzzy Hash: 823100B1D012589FDB14EFA9D894A9EFBF9EF48310F24842AE409B7240CB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1832334086.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e2f41cfc7d53eaedbb7d1d4857afc6e20b034e9e09b922d923caf27f9b2e1a
Instruction ID: 5dd89b83d7ed2487a96bae841cbd203184fcc17162924c1c64b3fb0690ab2d9b
Opcode Fuzzy Hash: 31e2f41cfc7d53eaedbb7d1d4857afc6e20b034e9e09b922d923caf27f9b2e1a
Instruction Fuzzy Hash: B82148B1508204DFDB05DF04DDC0B96BF65FB98324F20C568E80A5B246C336E896C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 06331F9F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858520840.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6330000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe184e70f8bfe4925e288b10d89e0f5100bb505e864490dd3baf49e511772d07
Instruction ID: c3b2b81e4f2719777a24a56571966fdb90ea4f4f0e0af5aca177da8f0eb79ec0
Opcode Fuzzy Hash: fe184e70f8bfe4925e288b10d89e0f5100bb505e864490dd3baf49e511772d07
Instruction Fuzzy Hash: 8E211935B40114AFCB44DFA8D984D9DBBB6FF49704B508095F6059F6A2CB72ED09DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1832839119.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac56307d8a0b4a8b646cebd2ba0b5676b7eb040e7ce4db86bd966baa040a1b6
Instruction ID: 60ccd03ff4aca34c013196d7cab01748b51e687cac1f294022825b971335dfc4
Opcode Fuzzy Hash: cac56307d8a0b4a8b646cebd2ba0b5676b7eb040e7ce4db86bd966baa040a1b6
Instruction Fuzzy Hash: DC21D375A04240EFCB14DF14D984B26BBA5EB94324F24C569D80A4B28AC336D807EA61

Uniqueness

Uniqueness Score: -1.00%

Function 06348A8C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39a0121c427d55d88a47a3ca943811dffb81704cd4ac208871280ed702c39d3
Instruction ID: c97c660740313cd9274e467a5dbd742d99a6c2b131f2130a7ee7e6d2ef8cabaa
Opcode Fuzzy Hash: c39a0121c427d55d88a47a3ca943811dffb81704cd4ac208871280ed702c39d3
Instruction Fuzzy Hash: FF2125B1D012489FDB14DFA9C894B9EFBF9EF48300F14842AE405B7390DB74A845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1832839119.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e301a02224a2cf6637265566b9ef5e8fa293c26f2de37385ba0c90e855704fc8
Instruction ID: 1c240da758842870b761be0ae175539fa988050ab5f420186becfe1202ba372c
Opcode Fuzzy Hash: e301a02224a2cf6637265566b9ef5e8fa293c26f2de37385ba0c90e855704fc8
Instruction Fuzzy Hash: 372195759093C09FC702CF24D594715BF71EB46324F28C5EAD8498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06348E70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebde8dd36c68a5977e663dd1d71628f9fc32d6699694e1218111332864a8d4b
Instruction ID: 7ec91285819feb3c517ef4704ea73120aafca726aa355a058018696fa6df22e9
Opcode Fuzzy Hash: bebde8dd36c68a5977e663dd1d71628f9fc32d6699694e1218111332864a8d4b
Instruction Fuzzy Hash: E321C274E122189FCB44DFA9E9886EDBBF6BF88310F10902AE805B3250DB746945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1832334086.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 6e94b87b345ba7f892944291650415a1573a30944ae97606ef6f4f297ed7d2be
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 15112676504240CFCB16CF00D9C4B56BF72FB94324F24C6A9D80A0B256C33AE89ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0634BF2D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5087ba4a45c28e0243c97379605d55aaa59b34161ea51ac52865d9fb4378a6
Instruction ID: 3da62baf95f4401484d9472767bf8ebb7c80a8e4d5affa6a273741e7886b7670
Opcode Fuzzy Hash: 4d5087ba4a45c28e0243c97379605d55aaa59b34161ea51ac52865d9fb4378a6
Instruction Fuzzy Hash: 6111E5312016004FCB45B738A8545AE3FE3EFC6362354485CF00ADBA12DD746AC78791

Uniqueness

Uniqueness Score: -1.00%

Function 06348350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4704a934acdeb0d3c7dbcd157c762b07f1b78c0fded5a3960dc0666f67dc5962
Instruction ID: bfeb74351a62cc62f995aa7daf51909fe0bddabd44d9dc753375a604d79ab41b
Opcode Fuzzy Hash: 4704a934acdeb0d3c7dbcd157c762b07f1b78c0fded5a3960dc0666f67dc5962
Instruction Fuzzy Hash: 41017171B101199BDF10DAA9AC85AAFFBFAEB84351F14803AE614D3240DB71A91587A1

Uniqueness

Uniqueness Score: -1.00%

Function 06348F28 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae854c848ab0711db49971335b5bf831d8f4f264da48bfd81fe8b43afac671bb
Instruction ID: 7a0634c145649fee7e6429e795572159be96bc5479b738e91911cd3144b142c5
Opcode Fuzzy Hash: ae854c848ab0711db49971335b5bf831d8f4f264da48bfd81fe8b43afac671bb
Instruction Fuzzy Hash: EE1127B5E00209CFCB04DFA8D5546EEBBB2EF88305F10806AD514B7260EB359A46CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0634C769 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3613e6e549086c156ec12bc602d432607a61f88ad5bfab8b77863cef01a96d4e
Instruction ID: 3e67b9fcfb38a8af04cdb0ec3d059d17e08af92a4c84e2bb10687ac965c52e63
Opcode Fuzzy Hash: 3613e6e549086c156ec12bc602d432607a61f88ad5bfab8b77863cef01a96d4e
Instruction Fuzzy Hash: 5C11C2742043008FC311EB74D04865A7FF2EFC931AB248A6ED05A8BA56CF74984ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 06348F38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8091d3524887224d59d0d290f2ef0ed710fcfa9a75679959ddc24f39a165aa44
Instruction ID: abbdd82ace4dcac006148b6f3b1f5cbd5b1f917d7e4a6b80f9dc0e61274c2986
Opcode Fuzzy Hash: 8091d3524887224d59d0d290f2ef0ed710fcfa9a75679959ddc24f39a165aa44
Instruction Fuzzy Hash: 55110270E012098FCB08DFA9D8449EEBBF6FF88311F10806AD515B7260EB756A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0634BF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd76bd025908a84022dd0502e0fe7aa9d9b00aacea679f997297d4455e6385ec
Instruction ID: f53e73fa033f6d020b15465ca5948d76f1f07c1bcb4488d071ef62d9d9fce295
Opcode Fuzzy Hash: fd76bd025908a84022dd0502e0fe7aa9d9b00aacea679f997297d4455e6385ec
Instruction Fuzzy Hash: 2C01B131200A058F8A44B738E45466E7AE3EFC53623A4582CF00A9BA01DE747EC78B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D885 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1832334086.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48e2cf551ec1f84ab53736f12d96e17c0c07eee8c3caf36a6307817795cb83a
Instruction ID: 3b52ace8f0c0eab0c65ff09b6bb3c7f4afc420870f386328c47bb04aab082284
Opcode Fuzzy Hash: b48e2cf551ec1f84ab53736f12d96e17c0c07eee8c3caf36a6307817795cb83a
Instruction Fuzzy Hash: A101F23100C740DAE7149A29CD84BE6FFE8EF51329F18C45AED092A282C638A880DB71

Uniqueness

Uniqueness Score: -1.00%

Function 06348C78 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096f8f37bfcc592ccca847214e18f9fcfe14937523cca4966d9034e70975780c
Instruction ID: e4de7b910eb7288afb903f60bcf78af208a16c01f3e7f799854519e8e44959e5
Opcode Fuzzy Hash: 096f8f37bfcc592ccca847214e18f9fcfe14937523cca4966d9034e70975780c
Instruction Fuzzy Hash: 0801A2757012095BE715AE68D84477FB79AEBC9351F00842AFD05D7394DA34DC158BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0634EB70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e08483a20d440e1d26092defc0746e426f1a20d4bc458419715455aadb309f
Instruction ID: 22a2202e2c3cdbbf597cdb47d8e80b543178b6ed2231a3ad95eec5d7bdc1c08a
Opcode Fuzzy Hash: 46e08483a20d440e1d26092defc0746e426f1a20d4bc458419715455aadb309f
Instruction Fuzzy Hash: 8201F4347083889FCB46EB78D8148A97FB6FF8620071488E9E945CB763DA32DD16C791

Uniqueness

Uniqueness Score: -1.00%

Function 0634C778 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ea2d22a76e5e0682f160261f2107733271a5c0c23b6f19aea60fd5dcce5a5f
Instruction ID: d489fc570591e0f30f7e1164b5c0732ac2974f505f5acbc5392c9d2480c836dd
Opcode Fuzzy Hash: 76ea2d22a76e5e0682f160261f2107733271a5c0c23b6f19aea60fd5dcce5a5f
Instruction Fuzzy Hash: E50192702003048FD324EF75D04465A7BF3EBC831AB208A2DD15A97B45DF74A94A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 06345508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a8aa104771a952b07c47fc51006a570e1a502bc5382d0d7a55f300ec49eb01
Instruction ID: 5e0aa3eb109202b33d02de05888477af5a3c302ef3e30e0035fdb54d6f94511d
Opcode Fuzzy Hash: b2a8aa104771a952b07c47fc51006a570e1a502bc5382d0d7a55f300ec49eb01
Instruction Fuzzy Hash: 16016234E11711CFDBA9AA25A404637F7F7BF84225B1488B8E40786A14DA71F484CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06346E90 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca83218ff22d5699c516a9270475d884873db4319352c83ed2fa35abbb44e5f
Instruction ID: cb7ce7315242bc8db7e177a09f51f8af4b6dc76896f9f95c053284c0ab77fdbb
Opcode Fuzzy Hash: 4ca83218ff22d5699c516a9270475d884873db4319352c83ed2fa35abbb44e5f
Instruction Fuzzy Hash: 82F0C8AB1041D42FCB914EA99C41BFB3FEDDB4D561B084056FA98E2241C439CA619770

Uniqueness

Uniqueness Score: -1.00%

Function 06348C10 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ef1661ed39f8f9171bb59a7d3d2a9658574266955e751000e49717e1808a2b
Instruction ID: 6b4be9c8324a436d5eeccbc3997271fbc54e77b5951e63195535867cbb80938a
Opcode Fuzzy Hash: b0ef1661ed39f8f9171bb59a7d3d2a9658574266955e751000e49717e1808a2b
Instruction Fuzzy Hash: 7DF0C2B23003055FD714DA64EC80BABBBEDEBC8321F11452EE109C7285EAB5E8018760

Uniqueness

Uniqueness Score: -1.00%

Function 06349168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c66993321a6b3e9a414bb8734503884cac3e3f45ddc2a052e4a1ceac55728f
Instruction ID: 3ce44cc978aeea309342f612d9b3aba3e3cb3b5b319c1d79d32a83a302c6c4e9
Opcode Fuzzy Hash: 35c66993321a6b3e9a414bb8734503884cac3e3f45ddc2a052e4a1ceac55728f
Instruction Fuzzy Hash: 9B01D6B4D05209EFCB44EFA9D9496AEFBF5BF48300F1084A9E815A3390D7741A40DF90

Uniqueness

Uniqueness Score: -1.00%

Function 06349158 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54215b3d20fd936960c3636e2a3d58d3e69f36c10a526422335f7ce9b0054966
Instruction ID: b2da76b32500456c3222fe17907f89a16e2af1c61e355254058566d1518757e0
Opcode Fuzzy Hash: 54215b3d20fd936960c3636e2a3d58d3e69f36c10a526422335f7ce9b0054966
Instruction Fuzzy Hash: C30144B4D0824ADFCB10DFA8D9497AEBFB0BB06311F2045A9E820A7391C7741A81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D884 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1832334086.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e14a2b4e0525a1c60c1180c232944252b4ee2617907a93877408975100bbed
Instruction ID: cab29a286a323f89d74bff79734b3eae70c0129e707792b280daf01889fde910
Opcode Fuzzy Hash: f3e14a2b4e0525a1c60c1180c232944252b4ee2617907a93877408975100bbed
Instruction Fuzzy Hash: 4DF062724083449AE7149E1ADC84BA2FFD8EB55739F18C45AED085B286C279AC84CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0634C440 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0bc52a3870aac90df1cedc567e8ae5d00687cea2d54cdc7a0f2ff8fde49965
Instruction ID: d4b46da0fc402ab9f01e77ca956f4cb57e7b87d3133e00e1efec3fe9be2f5d57
Opcode Fuzzy Hash: 9b0bc52a3870aac90df1cedc567e8ae5d00687cea2d54cdc7a0f2ff8fde49965
Instruction Fuzzy Hash: AF01D1705067418FC726DF29E818166BFF2FF89310B14865ED4CAC7A22CB74A40ACF81

Uniqueness

Uniqueness Score: -1.00%

Function 06348C20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be99fdb636a9a67e65f75b4fe437fd2a06d32ab64008baddba8d21bb56ed16e5
Instruction ID: 335b5e2c2f7840bc3a0bb05c79f7f8655511fd0201b701c07ab210b0ea8947b0
Opcode Fuzzy Hash: be99fdb636a9a67e65f75b4fe437fd2a06d32ab64008baddba8d21bb56ed16e5
Instruction Fuzzy Hash: 6EF05EB27002155FD714DA59EC44EABBBEEEBC8324F10452EE50AC7295EAB1EC0587B0

Uniqueness

Uniqueness Score: -1.00%

Function 06346E72 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67063a48e017f5f2c45032d390276654443c7886c52c3cabd91056c097f2e58d
Instruction ID: b47fafa45c7a792d47cf7cf1d11d7bb4c43cbb7773850f7494a6ed9e418a9bcb
Opcode Fuzzy Hash: 67063a48e017f5f2c45032d390276654443c7886c52c3cabd91056c097f2e58d
Instruction Fuzzy Hash: 3CF05E773041E42FCF928EA99C119FB3FEC9B8E262F094596FE94D5141C029C961DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 06346EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd09d5dc0415a91793833a0d7308d6d327bdefe5159d167f21278d17ea18d8c
Instruction ID: 12c2895bb977c6c24dc4e7f52e8213569f79820179bdff70a3e02a57b6856c61
Opcode Fuzzy Hash: 5bd09d5dc0415a91793833a0d7308d6d327bdefe5159d167f21278d17ea18d8c
Instruction Fuzzy Hash: BCF037762041E83F8B514EAA5C10CFB7FEDDA8E261B084156FFD8D2241C439C961ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 0634AF88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1776bd0262a8a028a6da99190069c3d1890c51bb8b1fe115e8cf88a1a2c3fa
Instruction ID: ad0665d9428659038d58156f7b93d7c51eb41a188f6a82c35469503f43eecbe3
Opcode Fuzzy Hash: 4a1776bd0262a8a028a6da99190069c3d1890c51bb8b1fe115e8cf88a1a2c3fa
Instruction Fuzzy Hash: FDF052B230D2A05FC7523738AC250BD7FE4D9D665230802DBE08ACB642CA0C6A02C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 0634B4B9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2afb285b3c5836d74516e4373335fe64c462bcfc8844b168930ef9f6f68a4f
Instruction ID: 288c5972c60054e646d08e2b33de14a64fa4d5c48e939f0395cb56f1de0d165e
Opcode Fuzzy Hash: 8c2afb285b3c5836d74516e4373335fe64c462bcfc8844b168930ef9f6f68a4f
Instruction Fuzzy Hash: 70F0E2703052416BC3102779E8197DABFD9EFCA365F004169F18DC3643CAB9288587A1

Uniqueness

Uniqueness Score: -1.00%

Function 063491E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f88eaf052a609e3c1407a3c8fe546fd664d9ef9796e10f0a7f944dcb5babbee
Instruction ID: 667e5c0c03092031ab27a653442c96a8fe65b04a430a61b4a02964b87dbc5996
Opcode Fuzzy Hash: 5f88eaf052a609e3c1407a3c8fe546fd664d9ef9796e10f0a7f944dcb5babbee
Instruction Fuzzy Hash: D7F05E317002044B8694EAA9E980666F7E9DF88665314C46ED90EC7740DA22FC028790

Uniqueness

Uniqueness Score: -1.00%

Function 063467C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee295bc6c87dadcf483812f5d6bbf4865142d31c2ed533c81c81a72386a32bc
Instruction ID: 7e0ce026ed36b2ac5d0dab1acc9e489359b537fec2e4cd1eb8034675b0fa16f0
Opcode Fuzzy Hash: 4ee295bc6c87dadcf483812f5d6bbf4865142d31c2ed533c81c81a72386a32bc
Instruction Fuzzy Hash: 02F02E72B003009FC720DBA8EC02F52BBE4AB43711F068267F214CF1E2E6B0E8098780

Uniqueness

Uniqueness Score: -1.00%

Function 0634C3E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963e4ba07434970d78aae936be51d4c1428dba33252446488d037b01ddaedf3
Instruction ID: a050fe8158a2586e3d629dc5e0539cf06e8fafea5cc548bb7b562501ca4343ca
Opcode Fuzzy Hash: 2963e4ba07434970d78aae936be51d4c1428dba33252446488d037b01ddaedf3
Instruction Fuzzy Hash: 35F0963020A7E14FC713973CE81979A3FE1DF86315B09089FE186CB552C6A558468751

Uniqueness

Uniqueness Score: -1.00%

Function 063454F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0f14af833162ba513cd5c539a8fc3dee34381020e8b4f9c2d9ffd8393743a9
Instruction ID: e0d7ca5c1651813783f8e3454623d1e9e003a06e003c0501e3271baa26152a5c
Opcode Fuzzy Hash: aa0f14af833162ba513cd5c539a8fc3dee34381020e8b4f9c2d9ffd8393743a9
Instruction Fuzzy Hash: 0EF02431901701CFDBA4DE21E540B77BBF2AF80325F4898ACE44746925CAB4F488CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06349294 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05304fc63f8a83913972d26b250aaff9232f40e372ceb31424ea9ae3f129026e
Instruction ID: 33c1cde78c4546a7e8cf07247006a48a95c2b59f342046bc419b3e5bea795f5e
Opcode Fuzzy Hash: 05304fc63f8a83913972d26b250aaff9232f40e372ceb31424ea9ae3f129026e
Instruction Fuzzy Hash: 7EF0B4B5E052449FD741FBA4D8517AABBB0EB51300F0041DAE4448B7E4E774AE51DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06348340 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b5e01e0cd4cf08960667518e2e904f8e4c5559c032f30cdd3ea655d7e64656
Instruction ID: e8422eede6c7ab3f42923f38e9220b6c00845de4ff43f8602e02c5fc3b4fd30a
Opcode Fuzzy Hash: 93b5e01e0cd4cf08960667518e2e904f8e4c5559c032f30cdd3ea655d7e64656
Instruction Fuzzy Hash: 5EF0A776F141155BCF10DAB9AC456AFBBE9AB84261F09883BD514D3240EB30D40587A2

Uniqueness

Uniqueness Score: -1.00%

Function 0634B4C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fa5df6fd7fe193b95a6d362ef10d49dd9c2a57d75cda49c377fc233b9f2f17
Instruction ID: 67be59a41896be40019b9a9881a83621832367a708e0fbb0caff1e362bcf8992
Opcode Fuzzy Hash: e8fa5df6fd7fe193b95a6d362ef10d49dd9c2a57d75cda49c377fc233b9f2f17
Instruction Fuzzy Hash: 30E092B13005116BC7506A7AE449A9E7AD9EBCE361F40462DF14ED3A42CE69284547A1

Uniqueness

Uniqueness Score: -1.00%

Function 0634C450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa21ffd31c9282ecc667df68bc1a0340c9c9ebc7dac95e9cf5dbf7053e5e426
Instruction ID: 92e052f02dd559c89aba03554847723a61c0ef1af1867c532c3c6115c27da904
Opcode Fuzzy Hash: 6fa21ffd31c9282ecc667df68bc1a0340c9c9ebc7dac95e9cf5dbf7053e5e426
Instruction Fuzzy Hash: C9F09070500B018FDB25DF26E408666BBF6FB8C301710C62EE54B83A11DB74A40ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 06345698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6ff349b09d37a80dd8213cf48644d85d63b386c65b3763ba3301d9bbe1bed7
Instruction ID: 33da3afc3f0af64a0b0d84a60ff8c00418589a70e84b22a8917b7a90338e6432
Opcode Fuzzy Hash: 7f6ff349b09d37a80dd8213cf48644d85d63b386c65b3763ba3301d9bbe1bed7
Instruction Fuzzy Hash: 0FE06DB210D210AFD345DA35A805887BBE8EB91220B02886EE444C7141F631E841C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 06349237 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2c2fe782f7a41a36075546ca9d0f6bb439f296e17902683ff719d3b257994f
Instruction ID: 6996ddac32e96157425ab80b86f178be7483df1cc6ecf46d1dcbfe770aa1b380
Opcode Fuzzy Hash: 4d2c2fe782f7a41a36075546ca9d0f6bb439f296e17902683ff719d3b257994f
Instruction Fuzzy Hash: B6F08C34E01208AFC780FFA4E995BAEBBF0AB05300F1082A9E404973A4E6705E55DF81

Uniqueness

Uniqueness Score: -1.00%

Function 0634C3F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e1d8758d1ab5b48e1884273f4d1296c742e2fc025e082f7b1ef4c64e74d573
Instruction ID: d3e90a514bbfaa07788041be9f669fd51989d3faa22ace04e5b34da612e228e6
Opcode Fuzzy Hash: 67e1d8758d1ab5b48e1884273f4d1296c742e2fc025e082f7b1ef4c64e74d573
Instruction Fuzzy Hash: 4EE065302007614FC711A73DE40979E7FE5DFC5316F04092DE246CBA41CBA56D468791

Uniqueness

Uniqueness Score: -1.00%

Function 0634AF40 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b9283c0cb141ab02be02185b5740abfc4211abd91771ef09056d56111ef514
Instruction ID: 6ec4bc777fe54c50479e8142905d53141fe37c2c909d87686479a79b899d5d51
Opcode Fuzzy Hash: a0b9283c0cb141ab02be02185b5740abfc4211abd91771ef09056d56111ef514
Instruction Fuzzy Hash: ABE0D8703141655BCB466338A4190BD7FD5DBC5623704426BE58987641CF1C295683D5

Uniqueness

Uniqueness Score: -1.00%

Function 0634B7D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4983a57ca71a03283775b2cb76508a7d3f32b838facd5ce392eb515d432c0573
Instruction ID: 5f5f019e329f53febdc17b659fdc1443af2a01c43f1312a6755035a3acdc1930
Opcode Fuzzy Hash: 4983a57ca71a03283775b2cb76508a7d3f32b838facd5ce392eb515d432c0573
Instruction Fuzzy Hash: 81F01535E00108EFCF41EFB4DA848CDBBB5EB04200F1482AAD905E7241EA305B45DB80

Uniqueness

Uniqueness Score: -1.00%

Function 06349248 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e7ab6329bfd37dabee69ce091605f4e745961290b5230f4673836208204906
Instruction ID: 8edc2c58b212f38bff22fbe09a598797bcc706e3e63de9a044cc3aca774c577b
Opcode Fuzzy Hash: a3e7ab6329bfd37dabee69ce091605f4e745961290b5230f4673836208204906
Instruction Fuzzy Hash: 77F0ED74E41308AFC794FFA4E851BAEBBB5AB44300F1081A9E81497394EB746E55CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 0634CF10 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43584fa4749badd5e8e5852b2826207277dfe0aede26cc8bc4f4d70c2a82b34
Instruction ID: df8c75e9c072ab8845d1bef8d56153f9dcbb8ded2536556e403969cd97b22fe2
Opcode Fuzzy Hash: e43584fa4749badd5e8e5852b2826207277dfe0aede26cc8bc4f4d70c2a82b34
Instruction Fuzzy Hash: BAE0DF3120A3808FCF02EF28F8006C83FA1FF4A620306419EE08DEB71BC6241D62C791

Uniqueness

Uniqueness Score: -1.00%

Function 0634E4BF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf15b530895cdfbb583ca311cd2989463743dc7186dab94a6dbbb773ee6aaa7
Instruction ID: 8c0dd5db558ab72ce870370f53d6346c43be7ff68711cdf2891ab6043c9f22d0
Opcode Fuzzy Hash: 2cf15b530895cdfbb583ca311cd2989463743dc7186dab94a6dbbb773ee6aaa7
Instruction Fuzzy Hash: 5BE09A71A05348EFCF02DFA8E9409A87FF0EB4621272006DEE008EB2A2D6340F209752

Uniqueness

Uniqueness Score: -1.00%

Function 063491DA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931246b0f57c1ff27846efb046b55adafeb9edc39f4a8413129d09d882f648fe
Instruction ID: e0687c528306367b7a8a102c8aa54ce4a1b1f69d9324f1c9b6255b2e319a9f9a
Opcode Fuzzy Hash: 931246b0f57c1ff27846efb046b55adafeb9edc39f4a8413129d09d882f648fe
Instruction Fuzzy Hash: 28E0C2716042081BC380EAD8EC80757FFEDDF89751B18886EE90DCB381ED22EC018790

Uniqueness

Uniqueness Score: -1.00%

Function 0634AF50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa63b14db33e031d5e95400b288d10d9c18e6eaf2307b6039834be26bdbb667
Instruction ID: a4495aa6e38f1d1c615f19cda63573a51f7bce93919ad262f9b6ecc997a9f5f8
Opcode Fuzzy Hash: 1fa63b14db33e031d5e95400b288d10d9c18e6eaf2307b6039834be26bdbb667
Instruction Fuzzy Hash: 69D02EB1310128A7CA453328F8094BE3BEAEBC8B22301422AF54AC3700CE2C2E0283D5

Uniqueness

Uniqueness Score: -1.00%

Function 0634B7E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4d8b94a2e4ff697dfe510e0d85b8ffddfc8cb737a4676f96801062f01d13c4
Instruction ID: 7ec00bbb0f91414ee57e12035fd5266dd8f145a746bf9a76306fceb4a3963d86
Opcode Fuzzy Hash: 4f4d8b94a2e4ff697dfe510e0d85b8ffddfc8cb737a4676f96801062f01d13c4
Instruction Fuzzy Hash: 5DE09A75D0020CEFCF41DFE4D9448DDBBB9EB48200F1082AAD915A3200EB315B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0634E540 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63688b45b5e1da3a3c8dafa43b3935e9f5eba555d730a3f1e9f7b30786f5d6db
Instruction ID: c866837422dbbfa908455c302e8afd9756c0b0aa3686e63e7c6e1e62c591e8e6
Opcode Fuzzy Hash: 63688b45b5e1da3a3c8dafa43b3935e9f5eba555d730a3f1e9f7b30786f5d6db
Instruction Fuzzy Hash: 43E086311012178BCA44FA14F986B84F7E5F74CB15F21511CF80A8B668C7746FAA8BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0634FBA2 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ab6cc4c5235247e66a8b88eb510d1d06edaab218f9dc5e9768f33158639ff6
Instruction ID: e27562d96cffdc63ef119e6dcf7f1ab7315031692c216798932b85fbedc1598b
Opcode Fuzzy Hash: 50ab6cc4c5235247e66a8b88eb510d1d06edaab218f9dc5e9768f33158639ff6
Instruction Fuzzy Hash: C7D05E2175E3E11B871362AC78140696FA6D9CB66635A01DFE445CB247C9644C1583A2

Uniqueness

Uniqueness Score: -1.00%

Function 0634E4D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa0feb6945d6d992185dab5a2aa15dbba3ae7161d65a47d785583defa6b9dde
Instruction ID: 5935b4264904654fdb7d3a9d698c91408dbb7ac88382a65566ab64045f8e3687
Opcode Fuzzy Hash: efa0feb6945d6d992185dab5a2aa15dbba3ae7161d65a47d785583defa6b9dde
Instruction Fuzzy Hash: E8D01271A01208FF8F00EFA8E90155D7BF5EB44215B10459DE40DE3741EA351F109790

Uniqueness

Uniqueness Score: -1.00%

Function 0634EBB8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b6a600509a935fb9426c2c94b6f864728c19bdb97ba3a41b75792a5d51afad
Instruction ID: 0aa41e3a0d803952a1052eb956befab22d3d7feebd70507469df621a366ab9d8
Opcode Fuzzy Hash: 55b6a600509a935fb9426c2c94b6f864728c19bdb97ba3a41b75792a5d51afad
Instruction Fuzzy Hash: 11E05B3529D3849FC703DB68D8548547F75BF4661075444CBF584CF533C2769824DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0634FF4C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8956f9a67d41702ccf13ba3dc4ee4899692399b0ab3529a23c7dfc732697b5
Instruction ID: 8cf079465a8606099571c4b29f531ec4f2cbe5ac1309df64a75216a4ff1215c9
Opcode Fuzzy Hash: 7d8956f9a67d41702ccf13ba3dc4ee4899692399b0ab3529a23c7dfc732697b5
Instruction Fuzzy Hash: D1D02236304011834F002928B8054D9BF82C6D32727288327E2B051EE0C620011BD2E0

Uniqueness

Uniqueness Score: -1.00%

Function 06343721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccc79b5cd40a1817b62e58f0f7f87263934fc3880555dc6e842433715df0307
Instruction ID: 729c00e655a40dde57f69717c5f97c40258052357332f2a4dc04847e65defe0d
Opcode Fuzzy Hash: fccc79b5cd40a1817b62e58f0f7f87263934fc3880555dc6e842433715df0307
Instruction Fuzzy Hash: 5EC09BF25655400BE30555745D06F477F149760346F0B98665202971C6D965D04199B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06992E88 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

$dq, xrefs: 06992F7B
$dq, xrefs: 06993039

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 2c5e60a3d3bc96c7340b312f69d2399f4c91447a122042f5a9ccdb5947d21538
Instruction ID: 98c4c489b4655dbb52053e91cdf57a599fc0ffa5c9152f981ce82dc969ea1dc1
Opcode Fuzzy Hash: 2c5e60a3d3bc96c7340b312f69d2399f4c91447a122042f5a9ccdb5947d21538
Instruction Fuzzy Hash: 4861CE74E002089FDB54DFA9C880ADDBBF2FF89310F649069E405BB265DB34A986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0699F078 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

0oGp, xrefs: 0699F4BF

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: 0oGp
API String ID: 0-2111374174
Opcode ID: 5aef3277e447cad5e1daf5ca6c1c3f040a7a50371211ae86bb38fb0e79500f75
Instruction ID: 6e929353869e746da7b418e5551b187cb95bb3bccbddbaee636e09203f1010b6
Opcode Fuzzy Hash: 5aef3277e447cad5e1daf5ca6c1c3f040a7a50371211ae86bb38fb0e79500f75
Instruction Fuzzy Hash: C7428F74E012288FDB64DF69C994BDDBBB2BF89300F1095E9D509AB264DB349E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06996050 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VWj, xrefs: 0699629B

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: \VWj
API String ID: 0-2419293905
Opcode ID: abaa7e893eaabf23aec6d1db115e961e33e4eaa53293c5aef26b48186081309f
Instruction ID: 023bbb9248dc5e99195bc34f824ccadbc4525701bc05ad35235a5cade0b1fd2e
Opcode Fuzzy Hash: abaa7e893eaabf23aec6d1db115e961e33e4eaa53293c5aef26b48186081309f
Instruction Fuzzy Hash: 73916F70E002099FEF64CFADD98179DBBF6BF89304F248529D405E7694EB349846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06346FE8 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00c0dcb633772ae8486898d28b456bda4b7fabb6ffdd22704e729f33b667760
Instruction ID: 43fed08a31b91600a196afb14e3075c0a4d1bb4e075342254529a23be05186e9
Opcode Fuzzy Hash: d00c0dcb633772ae8486898d28b456bda4b7fabb6ffdd22704e729f33b667760
Instruction Fuzzy Hash: 476222B06002009BD748DF68D45475ABEE6EB88309F64C85CD10D9F396DFBADA4B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 06346FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df2a027833bd39bf76943bb1ce5cdcff75461f569686557f62990119fb7a4d9
Instruction ID: a537de14abbed29abf55ae795a72fc663c49b6d7c0dedbadfe889f886937dea1
Opcode Fuzzy Hash: 1df2a027833bd39bf76943bb1ce5cdcff75461f569686557f62990119fb7a4d9
Instruction Fuzzy Hash: B06221B07002009BD748DF68D45475ABEE6EB88309F64C85CD10D9F396DFBADA4B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 05130040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858067786.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6604955d93c9dac7a4eac8b4cdb9a2c3b2b529b0800300c39eb1d353d6ebfc48
Instruction ID: acfc53032ccce257c5c8be33c09bd6f2bd6780f4ba621433a16b701fb92dc6c3
Opcode Fuzzy Hash: 6604955d93c9dac7a4eac8b4cdb9a2c3b2b529b0800300c39eb1d353d6ebfc48
Instruction Fuzzy Hash: 181296B4422B45AED320CF65ED4E9AD3FB2B745324B904219EAE11A2E1DFBC154BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 02B9DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1834835766.0000000002B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b90000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1731aa9126946091d955a2c4df1b707373344128ca5d30a18c2c71f68df6d1
Instruction ID: 34d55d5aef9bd8bb1587ed46be651986fc59ecba1e68bace401612fdd5a1ce92
Opcode Fuzzy Hash: ea1731aa9126946091d955a2c4df1b707373344128ca5d30a18c2c71f68df6d1
Instruction Fuzzy Hash: 37A16E32A102168FCF05DFB5C8805EEBBB2FF85310B1585BAE805AB265DB75D956CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05130006 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858067786.0000000005130000.00000040.00000800.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046ac9ccfa112f03141bf3e2caf73d8c25c2265c057ed2323b26511eb74d401b
Instruction ID: 1cd3c884657796382e9c0967fbb013424db134c9906e2198cf05e3cf81d4b312
Opcode Fuzzy Hash: 046ac9ccfa112f03141bf3e2caf73d8c25c2265c057ed2323b26511eb74d401b
Instruction Fuzzy Hash: 39C1F7B0422B45AED721CF25EC4A9AD7FB2BB85324F504219E5A16B2E1DFBC144BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 0699E598 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb6569dd846ad7b4b0340abcd0073ddc2bb09e0f46f8a1f26d7562d38fa1a88
Instruction ID: 8fc5a92f5a7862f35d50eb24873bc0d27bf39201cc41699dc8afd4f276357c7d
Opcode Fuzzy Hash: fdb6569dd846ad7b4b0340abcd0073ddc2bb09e0f46f8a1f26d7562d38fa1a88
Instruction Fuzzy Hash: AE91A5B0D012288FDB64DF69C951B9EBBB2BF89300F1091EAD409B7654DB345E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06998D99 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d809099c899c8a6297f3d7dec33a88b497f9f86209059e5fe7950827939fd523
Instruction ID: 2aa18c18d9c6b416971ba0c20b15c3802d1b745afe9742d71c4a2e627a4f624c
Opcode Fuzzy Hash: d809099c899c8a6297f3d7dec33a88b497f9f86209059e5fe7950827939fd523
Instruction Fuzzy Hash: A731C271E056188BEB58CFABD8406DEFBF7AFC9300F18D12AD419AB614EB301946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0699E4F4 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06a4b814bca105f3a86b108dc372af8b008d550ee622a015cd5d4f4be4a7ee4
Instruction ID: f0d3c2549c66d374a5d0ae487e56f4698347078b060d405b680805250b5a7efb
Opcode Fuzzy Hash: a06a4b814bca105f3a86b108dc372af8b008d550ee622a015cd5d4f4be4a7ee4
Instruction Fuzzy Hash: 3FF0C970C44219CFEFA0DF58D8987BEBA74AF0A305F105459D006B3990DB748A84DF96

Uniqueness

Uniqueness Score: -1.00%

Function 0699A8A3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1859287499.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6990000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde9a9ff45075609a2aad648fa2bd2c62745bc790141fe82db579054cccf500f
Instruction ID: cec1c8989cf6c34ec3f8ed168fdde0dae91345230dba6f0610fff426adbc689c
Opcode Fuzzy Hash: cde9a9ff45075609a2aad648fa2bd2c62745bc790141fe82db579054cccf500f
Instruction Fuzzy Hash: 3DE09A30C4610ECEEF588FAAC1197FFF634EB81200FA06845840277680DB708A468EB5

Uniqueness

Uniqueness Score: -1.00%

Function 0634E587 Relevance: 46.6, Strings: 37, Instructions: 387COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634EB04
D|j, xrefs: 0634E918
D|j, xrefs: 0634E940
D|j, xrefs: 0634E82B
D|j, xrefs: 0634E65D
D|j, xrefs: 0634E682
D|j, xrefs: 0634EB2F
D|j, xrefs: 0634EA08
D|j, xrefs: 0634E853
D|j, xrefs: 0634E990
D|j, xrefs: 0634E7B3
D|j, xrefs: 0634EA30
D|j, xrefs: 0634E8F0
D|j, xrefs: 0634E73B
D|j, xrefs: 0634E8A3
D|j, xrefs: 0634E6A7
D|j, xrefs: 0634E6CC
D|j, xrefs: 0634E5EE
D|j, xrefs: 0634EA83
D|j, xrefs: 0634E613
D|j, xrefs: 0634E8C8
D|j, xrefs: 0634E968
D|j, xrefs: 0634E78B
D|j, xrefs: 0634E803
D|j, xrefs: 0634E716
D|j, xrefs: 0634E7DB
D|j, xrefs: 0634E9E0
D|j, xrefs: 0634E763
D|j, xrefs: 0634E87B
D|j, xrefs: 0634EAAE
D|j, xrefs: 0634E9B8
D|j, xrefs: 0634E6F1
D|j, xrefs: 0634EA58
D|j, xrefs: 0634EAD9
D|j, xrefs: 0634E638
D|j, xrefs: 0634E5C9
D|j, xrefs: 0634E5A4

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-3555537224
Opcode ID: ce71ca04160aaab7693f6d3b2f72bcc0cea94d864c115b4c97c2ff5084548938
Instruction ID: 09eed469d374d9ca8bab19113bf9eb45cbcea5ed2be8efa21a21bff42fb32473
Opcode Fuzzy Hash: ce71ca04160aaab7693f6d3b2f72bcc0cea94d864c115b4c97c2ff5084548938
Instruction Fuzzy Hash: 6AD1A0307147126FC205A6B4DC92BBDAAD3BB8A701B845828E10D4FB95EF712E594397

Uniqueness

Uniqueness Score: -1.00%

Function 0634E598 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634EB04
D|j, xrefs: 0634E918
D|j, xrefs: 0634E940
D|j, xrefs: 0634E82B
D|j, xrefs: 0634E65D
D|j, xrefs: 0634E682
D|j, xrefs: 0634EB2F
D|j, xrefs: 0634EA08
D|j, xrefs: 0634E853
D|j, xrefs: 0634E990
D|j, xrefs: 0634E7B3
D|j, xrefs: 0634EA30
D|j, xrefs: 0634E8F0
D|j, xrefs: 0634E73B
D|j, xrefs: 0634E8A3
D|j, xrefs: 0634E6A7
D|j, xrefs: 0634E6CC
D|j, xrefs: 0634E5EE
D|j, xrefs: 0634EA83
D|j, xrefs: 0634E613
D|j, xrefs: 0634E8C8
D|j, xrefs: 0634E968
D|j, xrefs: 0634E78B
D|j, xrefs: 0634E803
D|j, xrefs: 0634E716
D|j, xrefs: 0634E7DB
D|j, xrefs: 0634E9E0
D|j, xrefs: 0634E763
D|j, xrefs: 0634E87B
D|j, xrefs: 0634EAAE
D|j, xrefs: 0634E9B8
D|j, xrefs: 0634E6F1
D|j, xrefs: 0634EA58
D|j, xrefs: 0634EAD9
D|j, xrefs: 0634E638
D|j, xrefs: 0634E5C9
D|j, xrefs: 0634E5A4

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-3555537224
Opcode ID: 802679a855c68114b637745c20986cd03d8393ab461bf4de20db61ce8666a240
Instruction ID: 1b9a29ee13113e8de2559dece8135ac0c30c18ff50196b540d9408219430eb46
Opcode Fuzzy Hash: 802679a855c68114b637745c20986cd03d8393ab461bf4de20db61ce8666a240
Instruction Fuzzy Hash: 84D1AF307147026FC205B6B4DC92BBDAAD3BB8A701B845838E10D4FB95EFB12E594397

Uniqueness

Uniqueness Score: -1.00%

Function 0634CF57 Relevance: 16.4, Strings: 13, Instructions: 148COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634CFBE
D|j, xrefs: 0634D0C1
D|j, xrefs: 0634CFE3
D|j, xrefs: 0634D02D
D|j, xrefs: 0634D130
D|j, xrefs: 0634D10B
D|j, xrefs: 0634D008
D|j, xrefs: 0634D052
D|j, xrefs: 0634CF74
D|j, xrefs: 0634D077
D|j, xrefs: 0634D0E6
D|j, xrefs: 0634D09C
D|j, xrefs: 0634CF99

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-3976991907
Opcode ID: 4a5e66f0630d6c457182e3be9f3336ee34d146b24b461c4791b25241ed9b6d1c
Instruction ID: e18bd1a5729a344c3a53d49df91ed094f9b44f998a0c762939dc2ac875163949
Opcode Fuzzy Hash: 4a5e66f0630d6c457182e3be9f3336ee34d146b24b461c4791b25241ed9b6d1c
Instruction Fuzzy Hash: 7841B4303047026FD305A6B4D8927BD6AD3FB8A701B844C38E20D4FA96DF752E994397

Uniqueness

Uniqueness Score: -1.00%

Function 0634CF68 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634CFBE
D|j, xrefs: 0634D0C1
D|j, xrefs: 0634CFE3
D|j, xrefs: 0634D02D
D|j, xrefs: 0634D130
D|j, xrefs: 0634D10B
D|j, xrefs: 0634D008
D|j, xrefs: 0634D052
D|j, xrefs: 0634CF74
D|j, xrefs: 0634D077
D|j, xrefs: 0634D0E6
D|j, xrefs: 0634D09C
D|j, xrefs: 0634CF99

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-3976991907
Opcode ID: 7b5c086bbe94975f98c6db8004ab577f7ecbd60379e8997c0c40ceb02cfa80c0
Instruction ID: 2233d95d95b132c5cdb1a0820b18622c2cc191321c7a312aef452abb3851b3ff
Opcode Fuzzy Hash: 7b5c086bbe94975f98c6db8004ab577f7ecbd60379e8997c0c40ceb02cfa80c0
Instruction Fuzzy Hash: A241A4303147126FD605A6B4D8827BE6AD3FB8A701B844C38E20D4FE85DF756E594397

Uniqueness

Uniqueness Score: -1.00%

Function 0634D1A9 Relevance: 10.1, Strings: 8, Instructions: 99COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634D2C7
D|j, xrefs: 0634D233
D|j, xrefs: 0634D20E
D|j, xrefs: 0634D2A2
D|j, xrefs: 0634D258
D|j, xrefs: 0634D1E9
D|j, xrefs: 0634D27D
D|j, xrefs: 0634D1C4

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-1603575766
Opcode ID: 92505009beeb53b6ce4ecc15b0387b5d1d9edf940c9ecaba23912be3e8da767e
Instruction ID: 8acbe0bdb76b25046d25431ff4a5e80af6d15614f39efc15924156d0d4fc649b
Opcode Fuzzy Hash: 92505009beeb53b6ce4ecc15b0387b5d1d9edf940c9ecaba23912be3e8da767e
Instruction Fuzzy Hash: 2531B9307043426FC706A6B498817BD6ED3BB8A700B845938E10D8FA96DF752E594397

Uniqueness

Uniqueness Score: -1.00%

Function 0634D1B8 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634D2C7
D|j, xrefs: 0634D233
D|j, xrefs: 0634D20E
D|j, xrefs: 0634D2A2
D|j, xrefs: 0634D258
D|j, xrefs: 0634D1E9
D|j, xrefs: 0634D27D
D|j, xrefs: 0634D1C4

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-1603575766
Opcode ID: a2aae3d4942ab0cec960ea0e916e87f3ecb02ff3d37a91b1604b3da1fc40819e
Instruction ID: 53548c856134c7291b98e21d9ab7457379f436f580ed9f1ddd83518233b2e67a
Opcode Fuzzy Hash: a2aae3d4942ab0cec960ea0e916e87f3ecb02ff3d37a91b1604b3da1fc40819e
Instruction Fuzzy Hash: 6F21C8307143122FC605A6B4D8827BDAAD3FB8A700B845838E20D4FB85DF752E994397

Uniqueness

Uniqueness Score: -1.00%

Function 0634CC40 Relevance: 8.8, Strings: 7, Instructions: 87COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634CCAE
D|j, xrefs: 0634CD52
D|j, xrefs: 0634CD00
D|j, xrefs: 0634CC85
D|j, xrefs: 0634CC5C
D|j, xrefs: 0634CD29
D|j, xrefs: 0634CCD7

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-1109028299
Opcode ID: 79802431b241419692d76e09fcd3f9be33b8a23558d02fb1c74cc696eb1f9778
Instruction ID: b6ef74a8e104697381cd522c42558af40373384c2caa1748699628c4d6c12a20
Opcode Fuzzy Hash: 79802431b241419692d76e09fcd3f9be33b8a23558d02fb1c74cc696eb1f9778
Instruction Fuzzy Hash: 043181303006816FCB052BA4D852ABD7FE3FB8A7017445478E10ADFB95DE705E9A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 0634CC50 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634CCAE
D|j, xrefs: 0634CD52
D|j, xrefs: 0634CD00
D|j, xrefs: 0634CC85
D|j, xrefs: 0634CC5C
D|j, xrefs: 0634CD29
D|j, xrefs: 0634CCD7

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-1109028299
Opcode ID: aef670c8e78bab7aa4c283e417b16532210d90ffbe1fe1ebb142588a56e7cb33
Instruction ID: 0e9beda9c436d7c255743c7929eb399d74567a5e356d9813f482c25adc4a6d86
Opcode Fuzzy Hash: aef670c8e78bab7aa4c283e417b16532210d90ffbe1fe1ebb142588a56e7cb33
Instruction Fuzzy Hash: FD21B4303006466FCB013BA4DC52ABD7BE3FB8A7017445438F10A9FB95DE705E9A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 0634D7F8 Relevance: 7.6, Strings: 6, Instructions: 79COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634D839
D|j, xrefs: 0634D814
D|j, xrefs: 0634D8CD
D|j, xrefs: 0634D85E
D|j, xrefs: 0634D883
D|j, xrefs: 0634D8A8

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-3256744231
Opcode ID: 318109dcd972af3a0f0359e41e94b1b4cb1341965426dda911a5659f55ba33c4
Instruction ID: 7c1be039e84a69e48bd98ad04a6cc4fa88b6bf7b89f6409c4f68d007e5bfe7f3
Opcode Fuzzy Hash: 318109dcd972af3a0f0359e41e94b1b4cb1341965426dda911a5659f55ba33c4
Instruction Fuzzy Hash: 5A21DD317043422FC30267B8D891BBD6ED3FB86714B844978E1098FA96DF715E994393

Uniqueness

Uniqueness Score: -1.00%

Function 0634D808 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

D|j, xrefs: 0634D839
D|j, xrefs: 0634D814
D|j, xrefs: 0634D8CD
D|j, xrefs: 0634D85E
D|j, xrefs: 0634D883
D|j, xrefs: 0634D8A8

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: D|j$D|j$D|j$D|j$D|j$D|j
API String ID: 0-3256744231
Opcode ID: f82d33711a88e2d59137e9f5436f3aedd19d2ea9986face0e35378a050f02202
Instruction ID: 7e2a9b0bd5513c9a08a3e06f2138a719d6ad08610ca82f697d6cc8d4a44370a1
Opcode Fuzzy Hash: f82d33711a88e2d59137e9f5436f3aedd19d2ea9986face0e35378a050f02202
Instruction Fuzzy Hash: 7511D8307043522FC30166A5D882B7DAAD3FB8AB00B844938E10D4FA85DF722E594393

Uniqueness

Uniqueness Score: -1.00%

Function 0634EFD0 Relevance: 5.2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

Strings

(_dq, xrefs: 0634F239
(_dq, xrefs: 0634F1BA
(_dq, xrefs: 0634F0B9
(_dq, xrefs: 0634F03A

Memory Dump Source

Source File: 00000000.00000002.1858541045.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_pdhmXuEYmc.jbxd

Similarity

API ID:
String ID: (_dq$(_dq$(_dq$(_dq
API String ID: 0-2092114380
Opcode ID: c602e82c6690d79761af5f773df070185bb92e5093221124e66dce14f353376d
Instruction ID: 1ca0971a463d341e481c64631f387fe0b90b02b24e93f259c4e1c8911875e6b2
Opcode Fuzzy Hash: c602e82c6690d79761af5f773df070185bb92e5093221124e66dce14f353376d
Instruction Fuzzy Hash: 21919E78B042449FCB45AF78C4145AE7BF2EF89350B64806EEC06DB382DA35DE46CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pdhmXuEYmc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdhmXuEYmc.exe.log

C:\Users\user\AppData\Local\Temp\TmpAA73.tmp

C:\Users\user\AppData\Local\Temp\TmpAA84.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
pdhmXuEYmc.exe

Function 0699D838 Relevance: 3.3, Strings: 2, Instructions: 766
COMMON

Function 0699BF50 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Function 06343F50 Relevance: 1.8, Strings: 1, Instructions: 523
COMMON

Function 06330D80 Relevance: 20.6, Strings: 16, Instructions: 621
COMMON

Function 06331582 Relevance: 7.8, Strings: 6, Instructions: 339
COMMON

Function 06348C88 Relevance: 2.6, Strings: 2, Instructions: 143
COMMON

Function 02B9AE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 06997BDD Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Function 05130BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON