Edit tour

Windows Analysis Report
W8Q1QyZc1j.exe

Overview

General Information

Sample name:	W8Q1QyZc1j.exe renamed because original name is a hash value
Original sample name:	a07998253a3ca569c961450b7c17b34c.exe
Analysis ID:	1430915
MD5:	a07998253a3ca569c961450b7c17b34c
SHA1:	af8dbe956f6177e72352b511133ca8ebc8c416cf
SHA256:	df8c1264b7ae61e5fca5741a1ca4e2800e96f8dc316e2d13d7088ad58aa3229a
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

W8Q1QyZc1j.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\W8Q1QyZc1j.exe" MD5: A07998253A3CA569C961450B7C17B34C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
W8Q1QyZc1j.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1638920972.0000000000402000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: W8Q1QyZc1j.exe PID: 6756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: W8Q1QyZc1j.exe PID: 6756	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.W8Q1QyZc1j.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 103.113.70.99 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-11:12:00.671354
SID:	2046056
Source Port:	2630
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-11:11:55.160540
SID:	2046045
Source Port:	49730
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-11:12:10.454454
SID:	2043231
Source Port:	49730
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 103.113.70.99 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-11:11:55.384877
SID:	2043234
Source Port:	2630
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: W8Q1QyZc1j.exe

Malware Configuration Extractor: RedLine {"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Multi AV Scanner detection for submitted file

Source: W8Q1QyZc1j.exe	ReversingLabs: Detection: 63%
Source: W8Q1QyZc1j.exe	Virustotal: Detection: 59%			Perma Link

Source: W8Q1QyZc1j.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: W8Q1QyZc1j.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBwinload_prod.pdb source: W8Q1QyZc1j.exe, 00000000.00000002.1887374668.00000000062A6000.00000004.00000020.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 103.113.70.99:2630 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 103.113.70.99:2630 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 103.113.70.99:2630

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 103.113.70.99:2630

Source: Joe Sandbox View

ASN Name: NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN

Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99

Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: W8Q1QyZc1j.exe, 00000000.00000002.1883715892.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9B
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002935000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: W8Q1QyZc1j.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp5138.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp5127.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05EF0D80	0_2_05EF0D80
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F067D8	0_2_05F067D8
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F0A3E8	0_2_05F0A3E8
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F03F50	0_2_05F03F50
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F0A3D8	0_2_05F0A3D8
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F06FF8	0_2_05F06FF8
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F06FE8	0_2_05F06FE8

Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs W8Q1QyZc1j.exe
Source: W8Q1QyZc1j.exe, 00000000.00000002.1883483569.0000000000938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs W8Q1QyZc1j.exe
Source: W8Q1QyZc1j.exe, 00000000.00000000.1638971035.0000000000446000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUpspearing.exe8 vs W8Q1QyZc1j.exe
Source: W8Q1QyZc1j.exe	Binary or memory string: OriginalFilenameUpspearing.exe8 vs W8Q1QyZc1j.exe

Source: W8Q1QyZc1j.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp5127.tmp

Jump to behavior

Source: W8Q1QyZc1j.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: W8Q1QyZc1j.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: W8Q1QyZc1j.exe	ReversingLabs: Detection: 63%
Source: W8Q1QyZc1j.exe	Virustotal: Detection: 59%

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: W8Q1QyZc1j.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: W8Q1QyZc1j.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: W8Q1QyZc1j.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: WINLOA~1.PDBwinload_prod.pdb source: W8Q1QyZc1j.exe, 00000000.00000002.1887374668.00000000062A6000.00000004.00000020.00020000.00000000.sdmp

Source: W8Q1QyZc1j.exe

Static PE information: 0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05EF4622 push 0000007Fh; ret	0_2_05EF4624
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F0E060 push es; ret	0_2_05F0E070
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F0ECF2 push eax; ret	0_2_05F0ED01
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F049AB push FFFFFF8Bh; retf	0_2_05F049AD
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Code function: 0_2_05F03B4F push dword ptr [esp+ecx*2-75h]; ret	0_2_05F03B53

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Memory allocated: BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe TID: 6532	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe TID: 6432	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: W8Q1QyZc1j.exe, 00000000.00000002.1887476034.00000000062E7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Users\user\Desktop\W8Q1QyZc1j.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: W8Q1QyZc1j.exe, type: SAMPLE
Source: Yara match	File source: 0.0.W8Q1QyZc1j.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1638920972.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W8Q1QyZc1j.exe PID: 6756, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^ql
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q%appdata%`,^qdC:\Users\user\AppData\Roaming`,^qdC:\Users\user\AppData\Roaming\Binance
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^q
Source: W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\W8Q1QyZc1j.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W8Q1QyZc1j.exe PID: 6756, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: W8Q1QyZc1j.exe, type: SAMPLE
Source: Yara match	File source: 0.0.W8Q1QyZc1j.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1638920972.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W8Q1QyZc1j.exe PID: 6756, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
W8Q1QyZc1j.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
W8Q1QyZc1j.exe	59%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://purl.oen	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://purl.oen	W8Q1QyZc1j.exe, 00000000.00000002.1883715892.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002935000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	W8Q1QyZc1j.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp, W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000298C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.000000000293D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	W8Q1QyZc1j.exe, 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.113.70.99	unknown	India		133973	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430915
Start date and time:	2024-04-24 11:15:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	W8Q1QyZc1j.exe renamed because original name is a hash value
Original Sample Name:	a07998253a3ca569c961450b7c17b34c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 74 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target W8Q1QyZc1j.exe, PID 6756 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	https://www.wsj.pm/download.php	Get hash	malicious	NetSupport RAT	Browse	103.113.70.37
	3A8YbQ0RZ7.dll	Get hash	malicious	Qbot	Browse	103.113.68.33
	onuxDag8Co.exe	Get hash	malicious	LummaC Stealer, RedLine, SectopRAT	Browse	103.113.68.183
	wssays.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	sgiydd.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	wssays.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	sgiydd.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	MO2XgKDI71.elf	Get hash	malicious	Unknown	Browse	103.132.130.140
	https://sekobank.com/te/?7338023	Get hash	malicious	Qbot	Browse	103.134.117.111

Process:	C:\Users\user\Desktop\W8Q1QyZc1j.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:29 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4576814301215766
Encrypted:	false
SSDEEP:	48:8SAdZTBnGRYrnvPdAKRkdAGdAKRFdAKR/U:8SWZ
MD5:	018097CD57872F7B247C20B5095C007A
SHA1:	489D7682473D4C0B71B18FD21317D7ABF610BFEC
SHA-256:	38D4593C180626C5D0A254093E50F891E5BA7BBC3D54BBC0895C1A740B8AC111
SHA-512:	FB0EE94AD859C9907D880F56210984C7F9447D3627DB36CEB47161AB430939B85C1CA9624775B09CD9389147162A4939AB2ECF115C80BD2DC60C9324A7095ADF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....].J........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWO`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWO`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWO`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\W8Q1QyZc1j.exe.log

Download File

Process:	C:\Users\user\Desktop\W8Q1QyZc1j.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp5127.tmp

Download File

Process:	C:\Users\user\Desktop\W8Q1QyZc1j.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp5138.tmp

Download File

Process:	C:\Users\user\Desktop\W8Q1QyZc1j.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\W8Q1QyZc1j.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.080994357975796
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	W8Q1QyZc1j.exe
File size:	311'410 bytes
MD5:	a07998253a3ca569c961450b7c17b34c
SHA1:	af8dbe956f6177e72352b511133ca8ebc8c416cf
SHA256:	df8c1264b7ae61e5fca5741a1ca4e2800e96f8dc316e2d13d7088ad58aa3229a
SHA512:	ccdd3e183bfb68d691afd1e99adf95b1bfac546ac3ee14d6ce57debbcb0ec66d2f3fc6f26713a9f43a4002078d55e2af9aa417509e7902e7cfc2b590360a0f8f
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
TLSH:	95645C1823EC8911E27F4B7994A1E274D375ED56A452E30F4ED06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F1DDCC88D02h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F1DDCC88D02h
jnc 00007F1DDCC88D02h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F1DDCC88D02h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F1DDCC88D02h
je 00007F1DDCC88D02h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F1DDCC88D02h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F1DDCC88D02h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b95c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b940	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e994	0x2ec00	64c48738b5efa1379746874c338807d5	False	0.4696168950534759	data	6.205450376900145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9d4	0x1cc00	5b3e8f48de8a05507379330b3cf331a7	False	0.23725373641304348	data	2.6063301335912525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	f921873e0b7f3fe3399366376917ef43	False	0.025390625	data	0.05390218305374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x35a	data	0.4417249417249417
RT_MANIFEST	0x4e7e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-11:12:00.671354	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2630	49730	103.113.70.99	192.168.2.4
04/24/24-11:11:55.160540	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	2630	192.168.2.4	103.113.70.99
04/24/24-11:12:10.454454	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	2630	192.168.2.4	103.113.70.99
04/24/24-11:11:55.384877	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2630	49730	103.113.70.99	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 11:16:20.157768011 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:20.378842115 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:20.378974915 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:20.387422085 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:20.618216991 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:20.671561003 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:20.674434900 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:20.899110079 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:20.952936888 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:25.940869093 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.167413950 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.167495966 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.167536020 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.167573929 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.167618036 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.167665005 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.167665958 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.218489885 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.285619974 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.528137922 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.577970028 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.585772991 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.820528984 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:26.820817947 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:26.842004061 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:27.064716101 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:27.064924002 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:27.068748951 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:27.293256998 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:27.302181959 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:27.525492907 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:27.529467106 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:27.753586054 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:27.791412115 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:28.031649113 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:28.033730030 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:28.274290085 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:28.327887058 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:28.671066046 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:28.913536072 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:28.915498972 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:28.941514969 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.162628889 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:29.218506098 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.326524019 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.565524101 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:29.609152079 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.666332006 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.908345938 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:29.908430099 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.924032927 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:29.924135923 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.939477921 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:29.939625978 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.957488060 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:29.957645893 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:29.959482908 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.154535055 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.154680967 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.174451113 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.174535990 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.174664974 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.174719095 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.174751997 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.174942970 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.175803900 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.175841093 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.175947905 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.176281929 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.176312923 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.176382065 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.195152044 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.383855104 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.384169102 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.406411886 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.406723976 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407069921 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.407224894 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.407226086 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407259941 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407401085 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407524109 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407730103 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407761097 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.407967091 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.408068895 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.629148960 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629201889 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629237890 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629527092 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629558086 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629587889 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629618883 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629811049 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.629980087 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630108118 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630141020 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630173922 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630268097 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630299091 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630328894 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.630430937 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.631350994 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.631505013 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.631536961 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.631699085 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632160902 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632193089 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632224083 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632320881 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632633924 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632675886 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.632788897 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.632792950 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.632822037 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633126974 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633162022 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633236885 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633431911 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633758068 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633910894 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633943081 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.633975983 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634007931 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634038925 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634069920 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634099960 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634133101 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634407043 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634561062 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634593010 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634705067 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.634737015 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.635056973 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.635288000 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.635411978 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.853226900 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853275061 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853312016 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853343010 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853374004 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853425980 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853477001 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853527069 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853880882 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853913069 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.853945017 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854088068 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854120016 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854325056 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854598999 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854651928 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854727030 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.854793072 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855025053 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855057001 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855087042 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855181932 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855437040 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855587959 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.855766058 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.855950117 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.880673885 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.880708933 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.880743027 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.880774975 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.880844116 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:30.881156921 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.881290913 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:30.887831926 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.079000950 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.079581022 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.079746008 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.079811096 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.080167055 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.080724955 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.083662987 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:31.083848953 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:31.101759911 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.110069990 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.110780001 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.110814095 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.111208916 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.111243963 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.111613035 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:31.307137966 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.307193995 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.307229996 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.307354927 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.308043003 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.308075905 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.308162928 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.308197021 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.308397055 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.309201956 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.343461990 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.343911886 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.343970060 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.345076084 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.346441031 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.348155975 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:31.586471081 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.591028929 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:31.824167967 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.825752974 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:31.874799013 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:31.910506964 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:32.131373882 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:32.136847973 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:32.361788988 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:32.363454103 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:32.601732016 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:32.606431007 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:32.906038046 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:32.921633959 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:32.924748898 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:32.925745964 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:33.154985905 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:33.197561979 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:33.197977066 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:33.481625080 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:33.613224983 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:33.614069939 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 11:16:33.902086973 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:34.083142996 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 11:16:34.114567041 CEST	49730	2630	192.168.2.4	103.113.70.99

Target ID:	0
Start time:	11:16:17
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\W8Q1QyZc1j.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\W8Q1QyZc1j.exe"
Imagebase:	0x400000
File size:	311'410 bytes
MD5 hash:	A07998253A3CA569C961450B7C17B34C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1638920972.0000000000402000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1884313773.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1884313773.0000000002BB8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 05EF0D80 Relevance: 20.6, Strings: 16, Instructions: 622COMMON

Download Yara Rule

Strings

$^q, xrefs: 05EF0FB8
$^q, xrefs: 05EF1455
$^q, xrefs: 05EF0F36
$^q, xrefs: 05EF1461
$^q, xrefs: 05EF0E02
$^q, xrefs: 05EF13EB
$^q, xrefs: 05EF0E52
$^q, xrefs: 05EF0FAC
$^q, xrefs: 05EF13AC
$^q, xrefs: 05EF0F86
$^q, xrefs: 05EF0E78
$^q, xrefs: 05EF1430
$^q, xrefs: 05EF137B
$^q, xrefs: 05EF13A0
$^q, xrefs: 05EF1336
$^q, xrefs: 05EF0E84

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2449488485
Opcode ID: 22446a9b76521d577f46d6f84acfcd20f55d8ee5cbef8c786fbdeaa896ba3869
Instruction ID: bd9932fa9c3e6bf08fd9752e440185b1911cf2ec6725ecd5f25773fa9c69f118
Opcode Fuzzy Hash: 22446a9b76521d577f46d6f84acfcd20f55d8ee5cbef8c786fbdeaa896ba3869
Instruction Fuzzy Hash: C5327E70B04209DFDB19DB69C858A7EBBE7BF88704B15945AE6468B392DF30DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05F03F50 Relevance: 1.8, Strings: 1, Instructions: 526COMMON

Download Yara Rule

Strings

$^q, xrefs: 05F041E4

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 48d365d8539c0c9a8804216c6b47050087a0b8b4538e38afd9a31b0025961729
Instruction ID: ae9c2b66cef59ad3d0872ed0dcf5074c59b4edec2ae60db909f99809e39a9fdd
Opcode Fuzzy Hash: 48d365d8539c0c9a8804216c6b47050087a0b8b4538e38afd9a31b0025961729
Instruction Fuzzy Hash: 49128174B002158FDB14DF69C854A6EBBF6FF88700B189569D906EB3A5DB35EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05F067D8 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9026201a7d300ce015cbcbb64c9b642608f713ccc70e4f3183aaa089b3775c3
Instruction ID: d66803fd10f196a1e7f08696c0ee84a926cd0832d4c282e06dcd456eff385c2f
Opcode Fuzzy Hash: e9026201a7d300ce015cbcbb64c9b642608f713ccc70e4f3183aaa089b3775c3
Instruction Fuzzy Hash: 0BF1E270A002199FDB14DF68D880B9EBBF2FF84311F188569E509EB291DB34ED56DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05F0A3D8 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec7bb9977d40a2df23cbf23ec178f1663532461e22eb65761963566469313f3
Instruction ID: 14706f78527e64a48c9ced2c9d8e46f3c45936a6b71622e999c91f0103fd6cc4
Opcode Fuzzy Hash: 2ec7bb9977d40a2df23cbf23ec178f1663532461e22eb65761963566469313f3
Instruction Fuzzy Hash: 88D10634910218CFDB28EFB4D844A9DBBB6FF8A301F1085A9E51AAB394DB355985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05F0A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec080429dda49c6ec032027b240d0e8e21a5ffefa27fed31c7af99f0d87fda3
Instruction ID: 9b321279233c49ba8d7f2794e83e3ba7b37b4991b39687d98a0c77de12d2d302
Opcode Fuzzy Hash: bec080429dda49c6ec032027b240d0e8e21a5ffefa27fed31c7af99f0d87fda3
Instruction Fuzzy Hash: FED1F334910218CFDB28EFB4D844A9DBBB6FF8A301F1085A9E51AAB394DB355985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05EF1582 Relevance: 7.8, Strings: 6, Instructions: 333COMMON

Download Yara Rule

Strings

$^q, xrefs: 05EF18E3
$^q, xrefs: 05EF182E
$^q, xrefs: 05EF1A7C
$^q, xrefs: 05EF1A57
$^q, xrefs: 05EF1A88
$^q, xrefs: 05EF1A12

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 12fc6c198a1e67f6bcd6fa9fc472fa507a9ee5d88b8985828333de730a132728
Instruction ID: 5ba76f4f659621d1dacc95c12fd4ee9adb9ede13ead9eba3ed6c1dc83a0af60b
Opcode Fuzzy Hash: 12fc6c198a1e67f6bcd6fa9fc472fa507a9ee5d88b8985828333de730a132728
Instruction Fuzzy Hash: 14C1EF70B04208DFDB189BA9C858A7AB7E7BF89704F149869E6478B392DF71DC01C791

Uniqueness

Uniqueness Score: -1.00%

Function 05F059D8 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

d, xrefs: 05F05C29

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: e7aa27fa820a93e46a8865f18bc9f68561dd4869e4f4f34858e8af9a1826ee76
Instruction ID: 35def9a293486f59404ce2aec8d5184c31e1f2a3f4b7e2d5969cbff1f11a771d
Opcode Fuzzy Hash: e7aa27fa820a93e46a8865f18bc9f68561dd4869e4f4f34858e8af9a1826ee76
Instruction Fuzzy Hash: A6C14734600602CFCB24DF29C48096ABBF2FF89310B5AC999D55A8B6A5D774FC46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05EF1BA0 Relevance: 1.4, Instructions: 1441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28530f6fb41786e02e5805b7613d8c27fd3ec2ecb7f345ba9ca52c51014c7b7
Instruction ID: 564a702f965dd5ad4be1fdcb1c9f408e513506726036356faab482fa6200eb58
Opcode Fuzzy Hash: d28530f6fb41786e02e5805b7613d8c27fd3ec2ecb7f345ba9ca52c51014c7b7
Instruction Fuzzy Hash: C8C23C74B001189FDB54DF68CC55AADBBB6FF88704F108099E60AAB3A1DB71ED418F91

Uniqueness

Uniqueness Score: -1.00%

Function 05F03DE0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05F03F25

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 410b64c0dc21b857e7ca44692154ef4da43daaac606b73a0e92146172f179362
Instruction ID: 402cb08f7d693638519daaffb13067e6f52a85eb6bf6f24ea2004f030124584d
Opcode Fuzzy Hash: 410b64c0dc21b857e7ca44692154ef4da43daaac606b73a0e92146172f179362
Instruction Fuzzy Hash: 7731F3317006108FD729AB38E45066E77E6EFCA35171949BAE40ACB381DE39EC478791

Uniqueness

Uniqueness Score: -1.00%

Function 05F084D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05F085B1

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: fd34fbe6f7b98780b7e701ee59c5f67fd914865c7240169fca542d800583bb1b
Instruction ID: e665a3074529d217490f61b6135beeba488443de07d00fb0cd717ddc88e99b0a
Opcode Fuzzy Hash: fd34fbe6f7b98780b7e701ee59c5f67fd914865c7240169fca542d800583bb1b
Instruction Fuzzy Hash: 5131AC31B002088BDB09BB78A49467E7BE7EFC8211B544439D50BCB386EE75DE0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 05F084C8 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05F085B1

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: c5abdbc96e4cc268606f3e1c434c5b9a620c84bacfcd90d9a7d09fd52750b010
Instruction ID: ab758348763b417968df7d0bfc9f2f9569387c632da4d8fc7fdea1caaac433b2
Opcode Fuzzy Hash: c5abdbc96e4cc268606f3e1c434c5b9a620c84bacfcd90d9a7d09fd52750b010
Instruction Fuzzy Hash: F2219E71B102048BDB09BB7894A467E3BE7AFC8211B54087DD50BCB386EE74CE0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 05F0B358 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05F0B399

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 7863a6108c8029c8beaae6441453753af293629059badc558a72973bdded0d56
Instruction ID: 438361a283213cd5bd03ad0d01760af1770bd03f5ee66b6bbc7b698cf1a30b92
Opcode Fuzzy Hash: 7863a6108c8029c8beaae6441453753af293629059badc558a72973bdded0d56
Instruction Fuzzy Hash: A101FC30902309AFCB04EFB4E8845ACBFF2FB45200B2405EAE94AD7201DB300E858B61

Uniqueness

Uniqueness Score: -1.00%

Function 05F03EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05F03F25

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 71762b19cf70e978d53bfcd24ff1c5f9c74a2f495c3eb779c5fef6a9a52464ec
Instruction ID: 35222283deddb53d7ed67955dabbe884825b6a4696df0bf56d411230715d497a
Opcode Fuzzy Hash: 71762b19cf70e978d53bfcd24ff1c5f9c74a2f495c3eb779c5fef6a9a52464ec
Instruction Fuzzy Hash: 75F090713006114BC21CEB29E450A6E77E6EBC96923144969E04E8B305EF60AD4787E1

Uniqueness

Uniqueness Score: -1.00%

Function 05F0B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05F0B399

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d7faf22e8680c58e64fd59c9547ea39f6fd1636a4a1a618ee69ce2b9ef737e89
Instruction ID: 29a2c295ff228497d927e348493e75425e3fe5edff47ca618f161936d74f5908
Opcode Fuzzy Hash: d7faf22e8680c58e64fd59c9547ea39f6fd1636a4a1a618ee69ce2b9ef737e89
Instruction Fuzzy Hash: F1F04F70A01209EFCB14EFB8E59855CBBF2FB44301B6455E9D60A97355DF301E44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05EF4762 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7772c2d4003c4bcfc2bdb79bdaeca8de92737e61d64dcaadd7319f38c8e3611
Instruction ID: 24760b218a681aa95e0bf98c1ee826545e7283b363f14e023e4da48bdded6360
Opcode Fuzzy Hash: d7772c2d4003c4bcfc2bdb79bdaeca8de92737e61d64dcaadd7319f38c8e3611
Instruction Fuzzy Hash: CE226E70B002449FDB45DF69D858A6EBBF6FF89704B15809AE606DB3A2CE71EC01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05EF00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bb49e2937229ed8e3732e6c57526769d092f11110978fb0a2bdbd3a44a7aac
Instruction ID: 16a4bbac961e50c835f28c99b4c3196d7790f46f1ed2756acb397c1627028313
Opcode Fuzzy Hash: 11bb49e2937229ed8e3732e6c57526769d092f11110978fb0a2bdbd3a44a7aac
Instruction Fuzzy Hash: 354279307006259FDB24AF78D458A2EB6E2FFC5705B444A9CD5079B392CF7AED018B82

Uniqueness

Uniqueness Score: -1.00%

Function 05EF0598 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cdd8dedf839fcd4d8b984aea21e8f891cc5b529b464d7cb17a4cf7fe6342cf
Instruction ID: bb5c302726c31fc5157ed7dd603b4e328859faa609b24a5f92ae3061624c31ac
Opcode Fuzzy Hash: f4cdd8dedf839fcd4d8b984aea21e8f891cc5b529b464d7cb17a4cf7fe6342cf
Instruction Fuzzy Hash: F2028B307007149FEB249F64D858A2E77E2FF89705F549999E6039B3A2CF76ED018B81

Uniqueness

Uniqueness Score: -1.00%

Function 05EF0688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e4ab5bf12516d970dcb9c2779d822835bdca2667e934dcb8e4940d30551b29
Instruction ID: 9d8bcaad7ff86da36b776ca8ca2dbcaa50ae14e39009e93a8b2dbe27935165e2
Opcode Fuzzy Hash: 24e4ab5bf12516d970dcb9c2779d822835bdca2667e934dcb8e4940d30551b29
Instruction Fuzzy Hash: ECE188307006149FEB149B64C858B6A77E7FB89704F5094A9EA039B3A2CF76ED01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05EF0700 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4208fa55de0a9360e0a9e8aa33a062d5cc269e58fdc6964ead78f4be1b99631e
Instruction ID: dcafee33cbc3cc1cc4bde58c8ef592b15a4dfbd00a91a175ac8d16c69eeb2357
Opcode Fuzzy Hash: 4208fa55de0a9360e0a9e8aa33a062d5cc269e58fdc6964ead78f4be1b99631e
Instruction Fuzzy Hash: 53D179307006409FEB549B64C85CB6976E7FB89705F5094A9EA039B3A2CF76ED01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05EF00BA Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656af68e9866c29c1ff4ce9176b09613924eec66ded76f637bd124e43576735c
Instruction ID: ee6c605813cbbfd6384714c8415f9d7c1f26fe81820db99a5fe02ad2719c82cc
Opcode Fuzzy Hash: 656af68e9866c29c1ff4ce9176b09613924eec66ded76f637bd124e43576735c
Instruction Fuzzy Hash: 4DC17A347002409FEB449B65C85DB797BE7BF89704F1090A6EA029B3A2DF76ED00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05EF3F0D Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70903a591732c61a795922455f195ddc55296a66af95d1c88148502f44d9f68
Instruction ID: 6ddb11f12d69f45a459ccbf0e97d22e838f00fd57cd459858f6d2af9a7d692e3
Opcode Fuzzy Hash: b70903a591732c61a795922455f195ddc55296a66af95d1c88148502f44d9f68
Instruction Fuzzy Hash: DFC10974B002148FDB44DF69C894EAEBBF6FF89704F158099E506DB3A2DA71ED448B50

Uniqueness

Uniqueness Score: -1.00%

Function 05EF0610 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6947166bfcca492248e809b5dac0f64ce8655852d31e186374e7e79938699f
Instruction ID: f417459157e1d4bd30121d473388feb484c01f3a1a52ee6a8ab3dc79924e3835
Opcode Fuzzy Hash: 8b6947166bfcca492248e809b5dac0f64ce8655852d31e186374e7e79938699f
Instruction Fuzzy Hash: 49C17834700240AFEB449B64C85DB7976E7FB89704F509069EA039B3A2DFB6ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05EF0666 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54417ef8c907fa999d261bf079a71a5d7372de32ee11df9c02d5bce51b106b4
Instruction ID: da77cf86cf5983d1d177104f6ed6b9007c4f6fc116c044a872d6e8e67ffb7c10
Opcode Fuzzy Hash: e54417ef8c907fa999d261bf079a71a5d7372de32ee11df9c02d5bce51b106b4
Instruction Fuzzy Hash: 2BB15734700240AFEB449B65C85DB7976E7FB89708F109065EA039B3A2DFB6ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05F04AFF Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eacb457463f35473919415122c81f66cf29e45c799c3e04c9e71630a9d71f98
Instruction ID: df49c287cc03d84aadb39f5b2d933e5f748a85c53b5b1b95f2af61a24d3ca063
Opcode Fuzzy Hash: 0eacb457463f35473919415122c81f66cf29e45c799c3e04c9e71630a9d71f98
Instruction Fuzzy Hash: EDC12C74B00605CFCB14DF69C488A6ABBF2FF89301B1985A9E546DB3A6DB34EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05F07D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e5273dbd4c85782cebbcabef59bd221a0b90fe6ea342aed67866a7162ea070
Instruction ID: 9e9164f15f2fcc81a8b13bc808c3f85e366c48ff0201fc6eb4c58e2bef6dc3a4
Opcode Fuzzy Hash: 89e5273dbd4c85782cebbcabef59bd221a0b90fe6ea342aed67866a7162ea070
Instruction Fuzzy Hash: D2514871E01218CFDB14DFA9C884B9EBBF6FF48310F188469D415AB284DB78A846DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05F07D4C Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b8723c434938e31e2c46f6a3d7617a03fe5f894d3ae1234fdf2ffdbba593ad
Instruction ID: 55060e5c584a33c0bc80b155dd8a5fab3c951e533fd3e4ba8e03368c35e3e05c
Opcode Fuzzy Hash: 04b8723c434938e31e2c46f6a3d7617a03fe5f894d3ae1234fdf2ffdbba593ad
Instruction Fuzzy Hash: A7513AB0E05258CFDB14DFA9C885B9DBBF6FF48300F189469D405AB284DB78A846DF81

Uniqueness

Uniqueness Score: -1.00%

Function 05F059C8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6373b3b085b1b2a2910a13fdd3af9e1f47b080b3d1f5ee6236b206010c8c3b26
Instruction ID: 6bad6df33111d516ded8f7184bdb2783c2a81454acfb6b6cf9a77c12cbd5194e
Opcode Fuzzy Hash: 6373b3b085b1b2a2910a13fdd3af9e1f47b080b3d1f5ee6236b206010c8c3b26
Instruction Fuzzy Hash: 18415434A00606DFCB14CF19C880D6ABBF2FF89310B59C9A9E5599B2A1D734F801DF84

Uniqueness

Uniqueness Score: -1.00%

Function 05F05579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2458aeafa54ecb1f0ff58833c96429de7958bc8dc3ac0de68cd79f17676dc07
Instruction ID: 1646aeef98a032ac414440cc491cb2b8663852d777c249c7ad625be833ec92db
Opcode Fuzzy Hash: f2458aeafa54ecb1f0ff58833c96429de7958bc8dc3ac0de68cd79f17676dc07
Instruction Fuzzy Hash: 6F316C75B012209FCB05DF35D88496EBBB2FF89302B548569E906CB3A5DB35ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05F0F920 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e51dd1d4e6c8608dc2c63688c1ef130b5ad6df30c3a069bf60fc62a204be80
Instruction ID: 1523bf3a25e586d66c1055112cbd8fefe1664beec82cb600e469d324b050e97c
Opcode Fuzzy Hash: a5e51dd1d4e6c8608dc2c63688c1ef130b5ad6df30c3a069bf60fc62a204be80
Instruction Fuzzy Hash: D53106397083515FCB296B78A81857E3FABEBC631135448EAE606CB395DE354D01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 05F05588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e915931791911d856c3e6880d7d04bbe532f5f8ba38d90d5af8daf1b7cffddcd
Instruction ID: 72874deabc6ded29c7333db7ded470ae354e9e0c0e938656341c4658cea51b62
Opcode Fuzzy Hash: e915931791911d856c3e6880d7d04bbe532f5f8ba38d90d5af8daf1b7cffddcd
Instruction Fuzzy Hash: 8B31A074B002209FCB05DF39D88496EBBB2FF89302B448469E906CB395DB34ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05F087A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1112e4fc5e6fa3dc78adc68811a46e3f2d8f33b828449f0c9e9d504e91a94c
Instruction ID: a867199a5f2811160493ef630a55c3a335c8f12b4981ae8cfea330417b4657e2
Opcode Fuzzy Hash: fd1112e4fc5e6fa3dc78adc68811a46e3f2d8f33b828449f0c9e9d504e91a94c
Instruction Fuzzy Hash: 4A41D2B1D01248DFDB14DFAAD954ADEFBF6AF88310F14802AE419B7290DB35A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05EF2EB4 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278407e5cec1b5b11d70f9351dc224d8d0c4c82fc4d791440f0425ecaf2bdc86
Instruction ID: ec97d121fc54d53a06dd167467046d9370c8d11688d6aaf35f57a1323b9bdaa1
Opcode Fuzzy Hash: 278407e5cec1b5b11d70f9351dc224d8d0c4c82fc4d791440f0425ecaf2bdc86
Instruction Fuzzy Hash: FE314E35E10619AFCB05CFA9D8809DEB7F6FF89314B15806AE905F7350EB71A845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05EF360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a98093d24afdd0450faf09d22166dbf9be3c9d51902d079d969b00e8c78bafe
Instruction ID: 9679d6579991fdd7bfeef5fa091b6384549bde0667881dbbae554b3250a1757b
Opcode Fuzzy Hash: 5a98093d24afdd0450faf09d22166dbf9be3c9d51902d079d969b00e8c78bafe
Instruction Fuzzy Hash: FC213C35B000149FCB54DF65C884DAABBB2FF8C714F1284A5EA0A9F3A2DA31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05EF4682 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887213983.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ef0000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9d03e4ba9c9a2c16afb8a65a5dfd393e30f8bbd3c0f292a2f5c95e4f346009
Instruction ID: b2ebe877fbb6fe69317c6061acf287ee82b484b8aaa7d5b7b963abb538ed82c5
Opcode Fuzzy Hash: 3e9d03e4ba9c9a2c16afb8a65a5dfd393e30f8bbd3c0f292a2f5c95e4f346009
Instruction Fuzzy Hash: 4C21F5357001148FDB44DF69C898EAABBF6FF88714B1584A9E606DB3A1DA71EC048B50

Uniqueness

Uniqueness Score: -1.00%

Function 05F08797 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c5a39e8ebbab83443661c383bd451d0401333eb229609f9a675572a4a9b1e9
Instruction ID: d19b1a3094fc542e60a3cb40573f8a2cdbbe5724ded54eeeb0c8be73275842a8
Opcode Fuzzy Hash: 48c5a39e8ebbab83443661c383bd451d0401333eb229609f9a675572a4a9b1e9
Instruction Fuzzy Hash: B431E2B1D012489FDB14DFAAD995ADEBFF6AF48300F18802AD419A7290DB359945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05F08A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7db9a605779bc22f5a3929529e5d419e63efdc0f7c5a692f137bd0a1cda3c0
Instruction ID: 074e5cf1cbb3693cb93d9d3340cc0d746663b756a5c61703d03a4743b36ef717
Opcode Fuzzy Hash: 2e7db9a605779bc22f5a3929529e5d419e63efdc0f7c5a692f137bd0a1cda3c0
Instruction Fuzzy Hash: DD3114B1D01258DFCB14DFA9D894ADEBBF9EF48350F14802AE405A7280CB78A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05F08A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5f4d9b0bdf97c17022713e969a7dfbc05a35555d2ea6e5b4fafd388df2bb4b
Instruction ID: 05b283ad1da23b6499ae8f634dd2efdc50365d2a15eaf6fbd981e5fe324ab662
Opcode Fuzzy Hash: 2d5f4d9b0bdf97c17022713e969a7dfbc05a35555d2ea6e5b4fafd388df2bb4b
Instruction Fuzzy Hash: 232126F1D00248DFDB14DFA9C995B9EBBF9BF08340F14842AE005A7280DB789846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05F0BC5F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852f0b1c48403ff4e37a326fed7fc23c1874b18334967859c503ec507978c743
Instruction ID: 7c58c384753c44aa00635e6da20a30e3b567eff39ef35b5e54876ae6687aff16
Opcode Fuzzy Hash: 852f0b1c48403ff4e37a326fed7fc23c1874b18334967859c503ec507978c743
Instruction Fuzzy Hash: 24110C302012165FC369A734A85057E3BE7EFC1A513A8091AF507CBB01CE306E8787A1

Uniqueness

Uniqueness Score: -1.00%

Function 05F0C499 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be49a0111c7287956881e0b00fc37da6625f88977430e51034db0a53e3cdfd9
Instruction ID: d8d7822c280dae86786b82ae63b066ab5650de3ae9d2c0c40eb9b2e9982d2054
Opcode Fuzzy Hash: 2be49a0111c7287956881e0b00fc37da6625f88977430e51034db0a53e3cdfd9
Instruction Fuzzy Hash: 130104302043058FD325AB74E40566E3BF3EFC5302B648A6AE14B87B45CF789E0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 05F08350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21025cadbeb1a9f93da4666a927cb2ea9ae47de7768b549d76c5d6d16cfaa4f
Instruction ID: 0c29383ddbbab14907dfa39d1756aa1ef253af29e2d0376dab6ad02a68a076a3
Opcode Fuzzy Hash: c21025cadbeb1a9f93da4666a927cb2ea9ae47de7768b549d76c5d6d16cfaa4f
Instruction Fuzzy Hash: 4701B171B002199BDF10DAA9AC45ABFBBEAFBC4751F184036E604D3240DB71990597A0

Uniqueness

Uniqueness Score: -1.00%

Function 05F0BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635c6ddbdb149d2e34dbce163409953135b3bea1e40d1cfc235b7e1c40988fbe
Instruction ID: 15569de55e33a13b47518745d6baadbf95e4f9fe6acd3e327402d521561a41d9
Opcode Fuzzy Hash: 635c6ddbdb149d2e34dbce163409953135b3bea1e40d1cfc235b7e1c40988fbe
Instruction Fuzzy Hash: 3B01D8312002164FC7A8A774E45463E7BD3EFC0B523A8491EE50B8B700DE307E878795

Uniqueness

Uniqueness Score: -1.00%

Function 05F0E8B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2254dc2192f2889a1dceb9bc610cb4b8edc35833ef77936f0dc3f8a79fd32e49
Instruction ID: aa9eee46d624568859241bd6c428f055a8c4cfd2a43c065d6728b9869f1adfbf
Opcode Fuzzy Hash: 2254dc2192f2889a1dceb9bc610cb4b8edc35833ef77936f0dc3f8a79fd32e49
Instruction Fuzzy Hash: 8D01F9386083489FCB12DF74D8148AA3FBAEF8630075484E9E545CB362DB36DD02D791

Uniqueness

Uniqueness Score: -1.00%

Function 05F05508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dead97f6307d1899448eec3d1d0ecc072de3dbfc1295b3075c7bf3939679f8c
Instruction ID: cbed8f13b255d42e727ef5489ff57cdde570997e62c9fb3d52e550f3f6a18bdf
Opcode Fuzzy Hash: 0dead97f6307d1899448eec3d1d0ecc072de3dbfc1295b3075c7bf3939679f8c
Instruction Fuzzy Hash: 5701A231A01711CFC724CA25E50093373E7FF8420E718A83CD00682584DAB9E481DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05F0C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b0d8951a0773e9716977d906bbe84901dec679d954e886e4caa80e9ba95744
Instruction ID: cb8a4a20071cf7c2af6f91864d7e70a342eb413d2bdf2c503044a0692fe3b2f8
Opcode Fuzzy Hash: b5b0d8951a0773e9716977d906bbe84901dec679d954e886e4caa80e9ba95744
Instruction Fuzzy Hash: 2501B5742043058FD324AF65D40465E77E3FFC5752B648A29D14B87B44CF74AD0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 05F06E90 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc90b437d3903eebcca964460252bcfc1ed164922116f66d321a08317361603
Instruction ID: 943ee4b041ac9d2db6f67b326ebecf8362359c9f004147150a2d65c4828411ac
Opcode Fuzzy Hash: 2cc90b437d3903eebcca964460252bcfc1ed164922116f66d321a08317361603
Instruction Fuzzy Hash: C8F096726041D83FDB254EAA9C10EFB3FEDDB8D162B084166FE98C1241C42DC952A770

Uniqueness

Uniqueness Score: -1.00%

Function 05F0C170 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e1cdd4f7f8be6c4b0a9c9083a6ac2ef74e9cf0f07720c0ad8698cdd6bc21f0
Instruction ID: b8c167bb44c1d13ceb62360e4caca2d24031e0e1737df8648997cd7e67030f93
Opcode Fuzzy Hash: a1e1cdd4f7f8be6c4b0a9c9083a6ac2ef74e9cf0f07720c0ad8698cdd6bc21f0
Instruction Fuzzy Hash: 0401D131502B019FD3219F26E808462BBFAFF89300750862AE987C3615CB70A60ACFD4

Uniqueness

Uniqueness Score: -1.00%

Function 05F0ADE9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7870b3f0f7f8aaffc3ec953a603f56c89cb34b37b36d13561ac54a29a644ad0e
Instruction ID: 94022d0705ec18b481a4d64bed586b943b215e226c14d06eeaf32439a44e246f
Opcode Fuzzy Hash: 7870b3f0f7f8aaffc3ec953a603f56c89cb34b37b36d13561ac54a29a644ad0e
Instruction Fuzzy Hash: 64F02E312052406FC3202769A859ADF7FEEEFCA751F0805ADF14EC7243C954580543F1

Uniqueness

Uniqueness Score: -1.00%

Function 05F08F43 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532084ad2940384df3b81d9eb74fe388660b8c0554ca47d228c120b4f6329ad4
Instruction ID: 38d5cc45bc4106a191ce985f8f36dd05429a7277a24412270b732ae639d0c520
Opcode Fuzzy Hash: 532084ad2940384df3b81d9eb74fe388660b8c0554ca47d228c120b4f6329ad4
Instruction Fuzzy Hash: 970108B4D04259EFCB04DFA4D5447AEBBB5FB08301F1051A9D415A3381D7390A40DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05F08F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5236a3cd0d49aa2f47d166d04bb58ea44d8f01371225545447dff0468c199f86
Instruction ID: 93beb75a8bf59b983f56e48935651f902576aed27118f4c418a8c798883b567d
Opcode Fuzzy Hash: 5236a3cd0d49aa2f47d166d04bb58ea44d8f01371225545447dff0468c199f86
Instruction Fuzzy Hash: DA01D6B4D04259EFCB04DFA9D9446AEFBF5FB48301F1490A9D415A3391E7780A40DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05F0ACB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d896b3fdb061afdf9caae9f6f6cd38b0d4ee765dc60897da28257d7a6eb02af1
Instruction ID: 0e2a46a58aa090ca0744078bb1586e9a81b9d2dc7ed03b93e8247ce185d61d67
Opcode Fuzzy Hash: d896b3fdb061afdf9caae9f6f6cd38b0d4ee765dc60897da28257d7a6eb02af1
Instruction Fuzzy Hash: 3BF059722092601FC32217386C144AE3FEEDA8666234902DBE186CB285CA58460393E1

Uniqueness

Uniqueness Score: -1.00%

Function 05F0C110 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337eb83a50ebcf4b639dde64b8b89511b6225bec73af388222458f0f4ecd7ea3
Instruction ID: 5a9ce8627a5ff576c369d6afc1d7d8dbebd988363c02b5bfd9934c7851e2c13c
Opcode Fuzzy Hash: 337eb83a50ebcf4b639dde64b8b89511b6225bec73af388222458f0f4ecd7ea3
Instruction Fuzzy Hash: 5EF0BB301097E15FC3229739E8146AB3FE6DF86305B08059FF286CB652CB655D05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05F06EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ae29b1f74c099c086a8bfce8ea6c9d3df6042a9508c4f8c87069bcb91a1b65
Instruction ID: 10d1581d1aee078b489a52ab433c8aec56f916350422738690d08e709bdc3a22
Opcode Fuzzy Hash: 34ae29b1f74c099c086a8bfce8ea6c9d3df6042a9508c4f8c87069bcb91a1b65
Instruction Fuzzy Hash: 3BF012722041E83F9B554EAA5C10DFB7FEDDB8E56270841A6FF98D2241C429C921ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 05F067C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7fcf90c63ada81c270e8fa1d12c9ff5026a3a07369dbb018b95db585ae35de
Instruction ID: b3dfe86a96990f15202145e8bb36eb817797192e4e90856d7d1011e1811537a1
Opcode Fuzzy Hash: 1b7fcf90c63ada81c270e8fa1d12c9ff5026a3a07369dbb018b95db585ae35de
Instruction Fuzzy Hash: 8EF09031B04300AFD7209A29E805F667BE5EF81716F15C166F254CB1E2D6B5E8459B80

Uniqueness

Uniqueness Score: -1.00%

Function 05F054F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56b7373912ae379b9db5b71d4cc32cd2e806cc41dfbbcdf4289bc2527c9b2b6
Instruction ID: 1a244ee1b114bb7202637645e5ed01a954341d4dfa1de11e40ff098c143d5490
Opcode Fuzzy Hash: a56b7373912ae379b9db5b71d4cc32cd2e806cc41dfbbcdf4289bc2527c9b2b6
Instruction Fuzzy Hash: FBF0F0316017018FCB24CE21D840B77BBB7FF80219F08A86CE04242995D6B9E585DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05F08FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b596bf4fc5c72592e82e9338bf1825afb2ef21c09359fbab132dcdcaf1f200bc
Instruction ID: c4fbe889d8491475307bbc99619129e0ac22dbeb1a9f9c38fc891b1c59ef9a1d
Opcode Fuzzy Hash: b596bf4fc5c72592e82e9338bf1825afb2ef21c09359fbab132dcdcaf1f200bc
Instruction Fuzzy Hash: 8DF04FB5C08159EFCB01CBB4C8555ADBFB1EB5A242F0452D6E446E7292E6394A01DB40

Uniqueness

Uniqueness Score: -1.00%

Function 05F08341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecff1efb0b3f85a4f75d9866c914565be9c32d881ef242d3974f3287a0399052
Instruction ID: 58d67c09b690edc838f81e65bc65d2a14cd489276dd2fffceef39c794cc1a9e7
Opcode Fuzzy Hash: ecff1efb0b3f85a4f75d9866c914565be9c32d881ef242d3974f3287a0399052
Instruction Fuzzy Hash: 43F0A771F102159F9F109A69AC499BF7BFDFB85291B08003BE914C3140FB748915C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05F0AC60 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec890b461bd1fd98e072f9a82bf228498d3d85d33522ca69af7b12414e209c1c
Instruction ID: ea382ae16b8e1f2af30f45a956a748b1034d064d45373c5bad31b59a39e9f40b
Opcode Fuzzy Hash: ec890b461bd1fd98e072f9a82bf228498d3d85d33522ca69af7b12414e209c1c
Instruction Fuzzy Hash: 1EF0A7766182A41FD227573868245EE3FAADBC662270901DBE589CB283CE540A05C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 05F0ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3914e4bc08305f963c72d825e8ff22c67d22f151c30fec20723adacc25bee01c
Instruction ID: d912ece205ca2822335094b234fc4db1718503605f46b58a03044d20d489cc27
Opcode Fuzzy Hash: 3914e4bc08305f963c72d825e8ff22c67d22f151c30fec20723adacc25bee01c
Instruction Fuzzy Hash: 92E092312041146BD3346A5AA849A9F7ADFEBC9751F44452DF20EC3346CA65580547E5

Uniqueness

Uniqueness Score: -1.00%

Function 05F0C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0936078dd26f6565fb46f64c024eb02b0c789c7cebb1145a5e862f30928fe854
Instruction ID: 44ef528008ebf86b5edf44db153cef307e6f3e2a4801463c8866f41f965c7347
Opcode Fuzzy Hash: 0936078dd26f6565fb46f64c024eb02b0c789c7cebb1145a5e862f30928fe854
Instruction Fuzzy Hash: 5AF03A75501B068FD725EF26E448566BBF6FF88301B50C62EE98B83A14DF70A549CF84

Uniqueness

Uniqueness Score: -1.00%

Function 05F0CC38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8ce61b840707d6ded38ab6c82cb1be2bccdeb8a5dd0097a096098e8cba420b
Instruction ID: e4ae675650ea8355eea57ddd434290ef9a48a08ee339be432abe41d25193cbe5
Opcode Fuzzy Hash: 3d8ce61b840707d6ded38ab6c82cb1be2bccdeb8a5dd0097a096098e8cba420b
Instruction Fuzzy Hash: 89E0D8311067519FD723FA14F844AFA3BA5DB42625B149292E101C7645C6380D4687D2

Uniqueness

Uniqueness Score: -1.00%

Function 05F0B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25d7b0b13c40e6201147b2ee4b4c45890728caf06fe3b7c47134282306a16f9
Instruction ID: 530d1417407d9ff73ef9cb014911195e287a810ea152a685d07efb498fcf9368
Opcode Fuzzy Hash: d25d7b0b13c40e6201147b2ee4b4c45890728caf06fe3b7c47134282306a16f9
Instruction Fuzzy Hash: 14F03935D0120DBFCB41DFB4E9489DEBFB9EB84200F2082A6E909E3240EA305B45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05F05698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25511614ec77e8815ee8c9608243ae83bcfb636d0488dd728681712a84246ca
Instruction ID: 0ae3460af5663114cd62f3e32673a53e659b1eb1bd1e112604f592639c6e48ae
Opcode Fuzzy Hash: c25511614ec77e8815ee8c9608243ae83bcfb636d0488dd728681712a84246ca
Instruction Fuzzy Hash: DEE092B250E3009FD344DB39E8048977BE8EB91221F06887EE440D7141E675D842CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05F0C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cfd1ff9b1162ae4b251a0aa0b9fac208bb2ff558fc543635c681cb9cc6f1e6
Instruction ID: 0e92a72dc51cadf0d445d080e2ff09f28962ea7db5bea188f3ddeff77b08e4d2
Opcode Fuzzy Hash: 35cfd1ff9b1162ae4b251a0aa0b9fac208bb2ff558fc543635c681cb9cc6f1e6
Instruction Fuzzy Hash: A3E065302047658FC721A72DE44879F7BE6DF85315F04096EE24687745CBA16905C795

Uniqueness

Uniqueness Score: -1.00%

Function 05F0CE88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e692e31700bca64211ea1db3da4e13df71f0b1cf592f8e00d71f99f82d28bb
Instruction ID: df6b7d9c94efb92cd7cddcc9454082c53ac6aa1d8ac35814acafea2b2bf2f043
Opcode Fuzzy Hash: 95e692e31700bca64211ea1db3da4e13df71f0b1cf592f8e00d71f99f82d28bb
Instruction Fuzzy Hash: 41E0D874005751EFD713B630B4059B63FB5EB8160472541C5EA4187646D73C4D428792

Uniqueness

Uniqueness Score: -1.00%

Function 05F0F910 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2a067ea0c34cfa4518061f9ac442e2ec382b7cc685bf0c398cd49d95066f50
Instruction ID: d02f5e283a8d6c2935cb83c9d696a45a45a429bb4be62530e047ee2e37e4f146
Opcode Fuzzy Hash: fb2a067ea0c34cfa4518061f9ac442e2ec382b7cc685bf0c398cd49d95066f50
Instruction Fuzzy Hash: 2BE02B247092215FEB19126D5C240FB7BAFEB8A61037980A7E546CB14ACD354C0B83E0

Uniqueness

Uniqueness Score: -1.00%

Function 05F0E8F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ff21ac622f5bcdfa74a4cc56d2601935de56d23b3799c9f65117a31a1af5ce
Instruction ID: b941eb25c4d04b22ace63c5916f607d3079e659656e7164c64a302f03c78fc37
Opcode Fuzzy Hash: a4ff21ac622f5bcdfa74a4cc56d2601935de56d23b3799c9f65117a31a1af5ce
Instruction Fuzzy Hash: B6E0E239256244AFD7029A64D840CA63F79EB4A61031450C6F991CF262C621ED229BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05F0E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069d2ee853e55ae3a29fdf8dc86fb83caf5a227965dc3cbbc2497150612d3d3c
Instruction ID: c3e8c9e7efba2b97113416b70f10a8aa1fd3a9f4922e56aa40a178bd46c35056
Opcode Fuzzy Hash: 069d2ee853e55ae3a29fdf8dc86fb83caf5a227965dc3cbbc2497150612d3d3c
Instruction Fuzzy Hash: ABE0DFB1A49319EFCB02DF64A841A9D3BF1DB82201F3441DBE90AE7252D6341F158752

Uniqueness

Uniqueness Score: -1.00%

Function 05F0E280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4339116a77dd0fdd3789ef712bbbd1e3228eae75a6b6d27300f5e27b44061ff
Instruction ID: d9bd2e04ae9740391e195a0c317cdc1ac175fd71498174b04784c00524901df8
Opcode Fuzzy Hash: b4339116a77dd0fdd3789ef712bbbd1e3228eae75a6b6d27300f5e27b44061ff
Instruction Fuzzy Hash: 1AE0D870505B51DFC713F720FC0199537E5F745B08B1550C5E5005B2AAC7680E45D7D2

Uniqueness

Uniqueness Score: -1.00%

Function 05F0AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03be12231b87cdfd1982465ae6e58b8d301094b27a6e70255f31bebb115c2a23
Instruction ID: f56e0f10466fb05c8abdcb8fa59c587e505f964479871d87910b6232a5553ee5
Opcode Fuzzy Hash: 03be12231b87cdfd1982465ae6e58b8d301094b27a6e70255f31bebb115c2a23
Instruction Fuzzy Hash: ABD05B713101285786252769B4185AE77DFDBC5772704062AF60BC3344CF651E0247D5

Uniqueness

Uniqueness Score: -1.00%

Function 05F0B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0475433de749968d8f1fea53234a278af24017ca836e48a889448f96cd643c
Instruction ID: aab1c2a7b8b9ed40e0449327d20c46fc098aafeef66224495ebe11adec1d4477
Opcode Fuzzy Hash: 1f0475433de749968d8f1fea53234a278af24017ca836e48a889448f96cd643c
Instruction Fuzzy Hash: 85E09A75D0020DEFCB50DFE4D5849DDBBB9EB48200F1082A6D905E3200EB305B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05F0F8E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1671c334eabbafd038f2f0d421c2483f0470ef94bc9f2143b19a0db8af13e38
Instruction ID: 94c13f34a71309f217dd884c11b85051b7ffcc532c6fcec8ea7d5c0ce85af055
Opcode Fuzzy Hash: e1671c334eabbafd038f2f0d421c2483f0470ef94bc9f2143b19a0db8af13e38
Instruction Fuzzy Hash: 87D0A7313040200FD3689B4CB40872EF9E7CBC8657B99815BF109CB340CAB588154390

Uniqueness

Uniqueness Score: -1.00%

Function 05F0E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7134f76f25effd9cd32fbeae2659057f492a9c04c820c55b1c906868ae571d01
Instruction ID: 283224217ca3951adfb52c87d5ff869c3dd78674ee3907a5fb02fdf855a68480
Opcode Fuzzy Hash: 7134f76f25effd9cd32fbeae2659057f492a9c04c820c55b1c906868ae571d01
Instruction Fuzzy Hash: 40D05EB2A0020DFFCB41EFA8E90195DB7F9EB44605B6045EAE509E7300EA312F009B91

Uniqueness

Uniqueness Score: -1.00%

Function 05F0DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6215257cbccbbc8357d2d3f647c5c180440d677a20955511c4eec4f0ffaac3
Instruction ID: 503e3c611f12278528e89bd54535fe2502c7c5ea5a82aa4d0f67c34ef9813208
Opcode Fuzzy Hash: 2c6215257cbccbbc8357d2d3f647c5c180440d677a20955511c4eec4f0ffaac3
Instruction Fuzzy Hash: E0C09B3554B3D05FEB071B309C0D8953F25FFD272472540CAE3418D063D5210405C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05F03729 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4122c33c1ff9e207e969bfd5e888b6a9e51fe2c3de971e3b8ad9bffd0021bb65
Instruction ID: 9976470af2d95fbc6505c8be133ff06d0f9736dbb9b8e0a43d03bb34b884b045
Opcode Fuzzy Hash: 4122c33c1ff9e207e969bfd5e888b6a9e51fe2c3de971e3b8ad9bffd0021bb65
Instruction Fuzzy Hash: 4BB01232801700FFD7009B62DA05F66B6A3F758703F018436F349814D9D2B64C61DF62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05F06FE8 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3065ae041352b3a939b40d5d03e26d16f0a34f382e36438d8a7d2949802dd42
Instruction ID: d24031ab3258a8c5f80886b6a3d6f464158f4c9198fb28a3d95a06f2f83f8003
Opcode Fuzzy Hash: e3065ae041352b3a939b40d5d03e26d16f0a34f382e36438d8a7d2949802dd42
Instruction Fuzzy Hash: FB6232B06003009FD748DF58D45871ABAE6EB85309F68C95CD10D8F392DFBADA4B9B91

Uniqueness

Uniqueness Score: -1.00%

Function 05F06FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad30b5716a5f2ab5ae31220f89a4620ebd6484b58956f7c9f81e0118c6be20
Instruction ID: 97449b0afbf01f62394af355852e45922c9e7299bcc96854b371bdbaaf20e895
Opcode Fuzzy Hash: 38ad30b5716a5f2ab5ae31220f89a4620ebd6484b58956f7c9f81e0118c6be20
Instruction Fuzzy Hash: E26232B06003009BD748DF58D45871ABAE6EB85309F68C95CD10D8F392DFBADA4B9B91

Uniqueness

Uniqueness Score: -1.00%

Function 05F0ED10 Relevance: 7.9, Strings: 6, Instructions: 381COMMON

Download Yara Rule

Strings

(_^q, xrefs: 05F0ED7A
(_^q, xrefs: 05F0EF79
(_^q, xrefs: 05F0F07A
(_^q, xrefs: 05F0EDF9
(_^q, xrefs: 05F0F0F9
(_^q, xrefs: 05F0EEFA

Memory Dump Source

Source File: 00000000.00000002.1887231419.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f00000_W8Q1QyZc1j.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q
API String ID: 0-2896069617
Opcode ID: 6eda8eeec9caf091ee9f505aef1d3648e0be7b446f546688f25f2ed81657ffc9
Instruction ID: 7116080334c492321cc041e9811dff14285e934837f5691209b83969350e0848
Opcode Fuzzy Hash: 6eda8eeec9caf091ee9f505aef1d3648e0be7b446f546688f25f2ed81657ffc9
Instruction Fuzzy Hash: F2D1D139B042049FDB159F78C4146AE7FF6FF85300B6885AAE906DB381DA35DE06CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report W8Q1QyZc1j.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\W8Q1QyZc1j.exe.log

C:\Users\user\AppData\Local\Temp\Tmp5127.tmp

C:\Users\user\AppData\Local\Temp\Tmp5138.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
W8Q1QyZc1j.exe