Edit tour

Windows Analysis Report
3q1lESMAMh.exe

Overview

General Information

Sample name:	3q1lESMAMh.exe renamed because original name is a hash value
Original sample name:	683f7f10d3bed4b98eb7c49d08e1529a.exe
Analysis ID:	1430963
MD5:	683f7f10d3bed4b98eb7c49d08e1529a
SHA1:	b0f755e1e567260255f1a2bb62989081357a19e3
SHA256:	91d1e460f32ef1914084e1cae335c4de321d1b69af18632eb80a55b924fca91d
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

3q1lESMAMh.exe (PID: 4024 cmdline: "C:\Users\user\Desktop\3q1lESMAMh.exe" MD5: 683F7F10D3BED4B98EB7C49D08E1529A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
3q1lESMAMh.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1186308201.0000000000762000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3q1lESMAMh.exe PID: 4024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3q1lESMAMh.exe PID: 4024	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.3q1lESMAMh.exe.760000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 103.113.70.99 - Destination IP: 192.168.2.7

Timestamp:	04/24/24-12:33:02.835353
SID:	2043234
Source Port:	2630
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.7 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-12:33:02.614303
SID:	2046045
Source Port:	49699
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 103.113.70.99 - Destination IP: 192.168.2.7

Timestamp:	04/24/24-12:33:08.108514
SID:	2046056
Source Port:	2630
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-12:33:20.351090
SID:	2043231
Source Port:	49699
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3q1lESMAMh.exe

Malware Configuration Extractor: RedLine {"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Multi AV Scanner detection for submitted file

Source: 3q1lESMAMh.exe	ReversingLabs: Detection: 63%
Source: 3q1lESMAMh.exe	Virustotal: Detection: 60%			Perma Link

Source: 3q1lESMAMh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3q1lESMAMh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Code function: 4x nop then jmp 08720D0Dh

0_2_08720CEC

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.7:49699 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.7:49699 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 103.113.70.99:2630 -> 192.168.2.7:49699
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 103.113.70.99:2630 -> 192.168.2.7:49699

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 103.113.70.99:2630

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 103.113.70.99:2630

Source: Joe Sandbox View

ASN Name: NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN

Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99

Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: 3q1lESMAMh.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp6AE4.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp6AD4.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_011925D8	0_2_011925D8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_0119DC74	0_2_0119DC74
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_05056948	0_2_05056948
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_05057C20	0_2_05057C20
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_05050006	0_2_05050006
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_05050040	0_2_05050040
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_05057C10	0_2_05057C10
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_063A67D8	0_2_063A67D8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_063AA3E8	0_2_063AA3E8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_063A3F50	0_2_063A3F50
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_063AA3D8	0_2_063AA3D8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_063A6FF8	0_2_063A6FF8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_063A6FE8	0_2_063A6FE8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08720DA0	0_2_08720DA0
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08720040	0_2_08720040
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_0872B720	0_2_0872B720
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08720D90	0_2_08720D90
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08720011	0_2_08720011
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_087283A8	0_2_087283A8
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08728399	0_2_08728399
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08721668	0_2_08721668
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Code function: 0_2_08721659	0_2_08721659

Source: 3q1lESMAMh.exe, 00000000.00000002.1389701886.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000000.1186334386.00000000007A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUpspearing.exe8 vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\080904B0\\OriginalFilename vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 3q1lESMAMh.exe
Source: 3q1lESMAMh.exe	Binary or memory string: OriginalFilenameUpspearing.exe8 vs 3q1lESMAMh.exe

Source: 3q1lESMAMh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

File created: C:\Users\user~1\AppData\Local\Temp\Tmp6AD4.tmp

Jump to behavior

Source: 3q1lESMAMh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3q1lESMAMh.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003181000.00000004.00000800.00020000.00000000.sdmp, 3q1lESMAMh.exe, 00000000.00000002.1391081505.000000000316B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 3q1lESMAMh.exe	ReversingLabs: Detection: 63%
Source: 3q1lESMAMh.exe	Virustotal: Detection: 60%

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 3q1lESMAMh.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3q1lESMAMh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 3q1lESMAMh.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 3q1lESMAMh.exe

Static PE information: 0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Code function: 0_2_063AECF2 push eax; ret

0_2_063AED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Memory allocated: 2B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Window / User API: threadDelayed 2729			Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Window / User API: threadDelayed 7049			Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe TID: 7384

Thread sleep time: -31359464925306218s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 3q1lESMAMh.exe, 00000000.00000002.1398582836.000000000643C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 3q1lESMAMh.exe, 00000000.00000002.1393860893.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Users\user\Desktop\3q1lESMAMh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3q1lESMAMh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.3q1lESMAMh.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1186308201.0000000000762000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3q1lESMAMh.exe PID: 4024, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q9C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\3q1lESMAMh.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3q1lESMAMh.exe PID: 4024, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3q1lESMAMh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.3q1lESMAMh.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1186308201.0000000000762000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3q1lESMAMh.exe PID: 4024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3q1lESMAMh.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
3q1lESMAMh.exe	61%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15V	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15V	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	3q1lESMAMh.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000003058000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, 3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	3q1lESMAMh.exe, 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.113.70.99	unknown	India		133973	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430963
Start date and time:	2024-04-24 12:32:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3q1lESMAMh.exe renamed because original name is a hash value
Original Sample Name:	683f7f10d3bed4b98eb7c49d08e1529a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:33:12	API Interceptor	50x Sleep call for process: 3q1lESMAMh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.113.70.99	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	https://www.wsj.pm/download.php	Get hash	malicious	NetSupport RAT	Browse	103.113.70.37
	3A8YbQ0RZ7.dll	Get hash	malicious	Qbot	Browse	103.113.68.33
	onuxDag8Co.exe	Get hash	malicious	LummaC Stealer, RedLine, SectopRAT	Browse	103.113.68.183
	wssays.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	sgiydd.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	wssays.exe	Get hash	malicious	Unknown	Browse	103.113.70.18

Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 06:54:36 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.482059516919292
Encrypted:	false
SSDEEP:	48:8SR7dvTgtX0lRYrnvPdAKRkdAGdAKRFdAKRr:8SLcR7
MD5:	764E212EF96C53E8E5AD6788332B8D3F
SHA1:	6C4A2D13B036E51B3E3FC6E46AB718125D336263
SHA-256:	5CCBCF45A022CAB682A835AD7D1B5B321059E7080DFA082678757923927E3E5D
SHA-512:	8F126EABCE4F4247CF42AEC5E74FDB91FEAE29EF6ED492767C251F8E1ADC1D59C574AA5018FAFBBB7E6D88C07690F80FA615481B5C1B8B17AA9C1005EC4140D8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....(../a....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.=..PROGRA~1..t......O.IEW.>....B...............J.......z.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.8....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.8..Chrome..>......CW.VEW.8....M.....................>.i.C.h.r.o.m.e.....`.1.....EW.8..APPLIC~1..H......CW.VEW.8..........................>.i.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.>..........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3q1lESMAMh.exe.log

Download File

Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp6AD4.tmp

Download File

Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp6AE4.tmp

Download File

Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.072306000159812
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	3q1lESMAMh.exe
File size:	312'107 bytes
MD5:	683f7f10d3bed4b98eb7c49d08e1529a
SHA1:	b0f755e1e567260255f1a2bb62989081357a19e3
SHA256:	91d1e460f32ef1914084e1cae335c4de321d1b69af18632eb80a55b924fca91d
SHA512:	60913e7f8fb8dc95a6605ec5dc922dfd868987c392c6cf9d0b6ec0d384ace4b3bc1d7c78c969d1eeecdfb340c88a68e4c17222cb26e9c2dda240f185311dc9f0
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
TLSH:	FF645C1823EC8911E27F4B7994A1E274D375ED56A452E30F4ED06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F7B0D4103C2h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F7B0D4103C2h
jnc 00007F7B0D4103C2h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F7B0D4103C2h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F7B0D4103C2h
je 00007F7B0D4103C2h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F7B0D4103C2h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F7B0D4103C2h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b95c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b940	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e994	0x2ec00	64c48738b5efa1379746874c338807d5	False	0.4696168950534759	data	6.205450376900145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9d4	0x1cc00	5b3e8f48de8a05507379330b3cf331a7	False	0.23725373641304348	data	2.6063301335912525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	f921873e0b7f3fe3399366376917ef43	False	0.025390625	data	0.05390218305374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x35a	data	0.4417249417249417
RT_MANIFEST	0x4e7e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-12:33:02.835353	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2630	49699	103.113.70.99	192.168.2.7
04/24/24-12:33:02.614303	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49699	2630	192.168.2.7	103.113.70.99
04/24/24-12:33:08.108514	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2630	49699	103.113.70.99	192.168.2.7
04/24/24-12:33:20.351090	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49699	2630	192.168.2.7	103.113.70.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:33:01.961807966 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:02.198571920 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:02.198749065 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:02.209431887 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:02.500441074 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:02.564820051 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:02.614303112 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:02.835352898 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:02.880181074 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:07.884546041 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:08.108514071 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.108544111 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.108561993 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.108603954 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.108645916 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.108648062 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:08.108700991 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:08.264081955 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:08.550153971 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.609126091 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.614217997 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:08.922280073 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:08.989151001 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:09.036468983 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:09.058301926 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:09.278800011 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:09.282073975 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:09.502485991 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:09.510786057 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:09.731307030 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:09.738203049 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:09.969259977 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:09.970676899 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:10.276346922 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:10.620661974 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:10.625324965 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:10.850351095 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:10.895874023 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:10.924946070 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:11.156363010 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:11.156456947 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:11.159445047 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:11.376507998 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:11.377182007 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:11.427253008 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:11.462554932 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:11.718271971 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:11.725893021 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:11.971461058 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:12.020855904 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:13.891928911 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:14.115155935 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:14.161482096 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:15.413499117 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:15.635543108 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:15.677170992 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:17.173392057 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:17.394026995 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:17.401843071 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:17.621831894 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:17.621901035 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:17.621952057 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:17.623095036 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:17.625155926 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:17.846645117 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:17.851078033 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.121771097 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.177939892 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.223984957 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.290518045 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.535959959 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.536051035 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.558152914 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.558353901 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.579802990 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.579925060 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.584115982 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.601288080 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.601414919 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.761460066 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.761511087 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.761534929 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.778563023 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.778605938 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.778639078 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.778681993 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.778758049 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.778824091 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.778831005 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.778907061 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.779021025 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.779078960 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.779303074 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.779352903 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.799702883 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.799824953 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.799962997 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.800318003 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.800342083 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.800362110 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.800501108 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.801153898 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821230888 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821276903 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821424007 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821511030 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821676016 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821752071 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821787119 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.821927071 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.822058916 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.981594086 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.981616020 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.998572111 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.998591900 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.998756886 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.998826981 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.998833895 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.998912096 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:18.999048948 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999121904 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999207973 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999279022 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999758005 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999773979 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999826908 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999841928 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:18.999963045 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000112057 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000196934 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000417948 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000597000 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000638008 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000936031 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.000976086 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.001257896 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.001364946 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.001466036 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.001643896 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.001785994 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.001962900 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.002188921 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.002253056 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.218677998 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.218703032 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.218717098 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.218905926 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219037056 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219050884 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219244003 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219259024 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219316006 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219393015 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219561100 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219713926 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219747066 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219815969 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.219933987 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220172882 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220267057 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220330000 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220534086 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220582962 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220731020 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220819950 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.220956087 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.221463919 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.221513033 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.221885920 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.221916914 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.221960068 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.222065926 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.222135067 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.222153902 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.222213984 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.222270012 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.222326040 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.222502947 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223093033 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223108053 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223160028 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223225117 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223268032 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223489046 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223576069 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223702908 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.223718882 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224028111 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224095106 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224203110 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224334955 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224455118 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224469900 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224536896 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224674940 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.224888086 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.225080013 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.225143909 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.442003012 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442025900 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442044020 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442197084 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442246914 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442265987 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442425966 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442630053 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442758083 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442867041 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.442929983 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443064928 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443161964 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443316936 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443331003 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443464994 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443583012 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443759918 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443814993 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443850994 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.443938017 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444139004 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444154024 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444289923 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444536924 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444643974 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444721937 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444854021 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.444880962 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.444953918 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.444956064 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445035934 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445125103 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445269108 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445390940 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445528030 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445648909 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445683002 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445801973 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.445956945 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446039915 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446054935 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446232080 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446423054 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446538925 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446578979 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.446829081 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.447076082 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.447139025 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.447170973 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.447366953 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.447423935 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.685796976 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.687355042 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.687444925 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.687505007 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.687670946 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.701224089 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.701241970 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.701462030 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.701535940 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.702096939 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702152014 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702275991 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702294111 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702349901 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702393055 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702508926 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702544928 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.702781916 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.703102112 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:19.934031963 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.955926895 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.977375031 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:19.999281883 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.021385908 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.042860985 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.051974058 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.053157091 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.056305885 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.057792902 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.062355042 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.128297091 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.128958941 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:20.350076914 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.351089954 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:20.576270103 CEST	2630	49699	103.113.70.99	192.168.2.7
Apr 24, 2024 12:33:20.630259991 CEST	49699	2630	192.168.2.7	103.113.70.99
Apr 24, 2024 12:33:20.679799080 CEST	49699	2630	192.168.2.7	103.113.70.99

Target ID:	0
Start time:	12:32:59
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\3q1lESMAMh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3q1lESMAMh.exe"
Imagebase:	0x760000
File size:	312'107 bytes
MD5 hash:	683F7F10D3BED4B98EB7C49D08E1529A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1186308201.0000000000762000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1391081505.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1391081505.0000000002ECF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	130
Total number of Limit Nodes:	10

Executed Functions

Function 063A3F50 Relevance: 3.0, Strings: 2, Instructions: 522
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k ,n^, xrefs: 063A4375
$q, xrefs: 063A41E4

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: $q$k ,n^
API String ID: 0-2957296497
Opcode ID: 68b70e9b42fb159c864d4c6d67140dbc8b1a1152ceaa58ed09841cbebe04827e
Instruction ID: 84ef85f2cbb007991826cc8299678eb2da9c1c3e815ab364a567d5d36ac99945
Opcode Fuzzy Hash: 68b70e9b42fb159c864d4c6d67140dbc8b1a1152ceaa58ed09841cbebe04827e
Instruction Fuzzy Hash: 38125B34F002158FDB54DF69D484AAEBBF6FF88210B158169E806EB365DB71EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08720040 Relevance: 2.0, Strings: 1, Instructions: 752
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@B/, xrefs: 08720357

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: @B/
API String ID: 0-3863299084
Opcode ID: d3eb59382a91bb13029f5e1e9d262d22cadfe337c7be7e11087845ee6648af18
Instruction ID: 3b6e69496536b53b0f80805c045e4a1d7c0d93a276f00eaeca42b066538e2b20
Opcode Fuzzy Hash: d3eb59382a91bb13029f5e1e9d262d22cadfe337c7be7e11087845ee6648af18
Instruction Fuzzy Hash: 87828974E01629CFDB64DF69C984BDDBBB2BB89301F1481EAD409A7254DB319E81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0872B720 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3340cd12ec6ab7774cb0ad1e726c5a0ef9439af96a57f270a4e7c31d83a2f3a
Instruction ID: 596f068191e6de5348dd37c00637a3960d0ea02b4429a31e55cd39770e981995
Opcode Fuzzy Hash: f3340cd12ec6ab7774cb0ad1e726c5a0ef9439af96a57f270a4e7c31d83a2f3a
Instruction Fuzzy Hash: 10229930B01214CFDB19DB69D5A0BAEB7F6AF88315F2444ADE5469B3A4CB34ED01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 063A67D8 Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409996ccf5060de309ab608b6671d4284fe9b4089d340ee0d25198e0cbf150f7
Instruction ID: a58f81e4a81c79aca38e6f0c3ce18a45561cbc8e740205dc1bf511718396b663
Opcode Fuzzy Hash: 409996ccf5060de309ab608b6671d4284fe9b4089d340ee0d25198e0cbf150f7
Instruction Fuzzy Hash: 2122AD31A003199FDB55DF68D881B9EBBF6FF85310F188569E5099B261DB30EC4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 05056948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1397396081.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5050000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb25f3631d0fd5aa489218b29af7770099168cec4c0364faa679fc175d3f989
Instruction ID: d91be28a206e8f152636c0ada07cddd18c6623fad13894a40c043001c29299b4
Opcode Fuzzy Hash: 8eb25f3631d0fd5aa489218b29af7770099168cec4c0364faa679fc175d3f989
Instruction Fuzzy Hash: 5122EE74901228DFDB65DF64D954BEABBB2FF4A300F4090E9D509AB2A1DB359E84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 08720DA0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f2144ddd02ac20a2f24caeca6b018bf5a594676fde29bdf1c25702bb140435
Instruction ID: 6264fdfc1e2b185d97d09bf473567fe9b0ef2beb422d0c2e44d8d774fba66fc3
Opcode Fuzzy Hash: 70f2144ddd02ac20a2f24caeca6b018bf5a594676fde29bdf1c25702bb140435
Instruction Fuzzy Hash: 4EE1C174E01228CFDB64CFA9C950B9EBBB2BF89300F5091AAD449B7254DB345E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 063AA3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc78417526617caa99a2d1834aaf2cc937ce7e32f4170b1b480075b48d7a692f
Instruction ID: 2056775438929d58b8609663919c24c120340f9b4a0ead5e5ae5e882b392ecc0
Opcode Fuzzy Hash: fc78417526617caa99a2d1834aaf2cc937ce7e32f4170b1b480075b48d7a692f
Instruction Fuzzy Hash: 96D1E530D00318CFCB58EFB4D854AADBBB6FF8A301F5085A9D54AAB254DB319986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 063AA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a573aade314b6b12680c94ec5feeceab4b5404d7010c34b41b70fd984877b156
Instruction ID: d07319120d7e6581f4c5820bb28f7f8613fb3d8039ca18295e5d50607d347973
Opcode Fuzzy Hash: a573aade314b6b12680c94ec5feeceab4b5404d7010c34b41b70fd984877b156
Instruction Fuzzy Hash: 85D1D530D00318CFCB58EFB4D854A9DBBB6FF8A301F6085A9D50AAB254DB319986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05057C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1397396081.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5050000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4056955b9429b20b4876fbc6bd3c0b1c41dcdc15cadc12a6445177e2e233211c
Instruction ID: ab9aa86a21459ecc50a3e1bb836a4632a47f8b156cc61ae123984d499d715673
Opcode Fuzzy Hash: 4056955b9429b20b4876fbc6bd3c0b1c41dcdc15cadc12a6445177e2e233211c
Instruction Fuzzy Hash: E5C18274E00218CFDB14DFA9D945B9EBBB2FF89300F24D1A9D809A7255DB30A986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05057C10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1397396081.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5050000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c87e9323dadd78da8ffe1d089130fad613229733e15060af0d699fe440ff75f
Instruction ID: 71506702120999adee1c21e934904c826a2e55a370e54311bb6619bc4f8439eb
Opcode Fuzzy Hash: 3c87e9323dadd78da8ffe1d089130fad613229733e15060af0d699fe440ff75f
Instruction Fuzzy Hash: 9C51A774E006188BEB18DFA6D941B9EFBB3BFC8300F14C0A9981DAB259DB3459469F50

Uniqueness

Uniqueness Score: -1.00%

Function 06390D80 Relevance: 20.6, Strings: 16, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06390E52
$q, xrefs: 06390FB8
$q, xrefs: 06390F86
$q, xrefs: 06391430
$q, xrefs: 06390FAC
$q, xrefs: 06391336
$q, xrefs: 0639137B
$q, xrefs: 06390E84
$q, xrefs: 063913AC
$q, xrefs: 06390E02
$q, xrefs: 06390E78
$q, xrefs: 06391461
$q, xrefs: 06390F36
$q, xrefs: 063913EB
$q, xrefs: 063913A0
$q, xrefs: 06391455

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-2144323406
Opcode ID: 73a23ff18d165fea358156cd57c68ef158366320d2b6af7f24d952450275f8c6
Instruction ID: 04aeecf99d861cd5686ff6d8a2821cc2d10dcc99580e837dae86ae63e1bf1653
Opcode Fuzzy Hash: 73a23ff18d165fea358156cd57c68ef158366320d2b6af7f24d952450275f8c6
Instruction Fuzzy Hash: 6C32B230B002069FEF599B65C854A6EBBF6FF89604B14846AE506DB7A1CB34DC05CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 06391582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 063918E3
$q, xrefs: 06391A57
$q, xrefs: 0639182E
$q, xrefs: 06391A88
$q, xrefs: 06391A12
$q, xrefs: 06391A7C

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: d7c93fa9867056b351b9eb51f63bd8137be488f0c924ccbea69bd53e9129ac8d
Instruction ID: 6a24865fbb4ea5b75843928fa0e6fd9260adf87daa2ebefc12e30967d45edc56
Opcode Fuzzy Hash: d7c93fa9867056b351b9eb51f63bd8137be488f0c924ccbea69bd53e9129ac8d
Instruction Fuzzy Hash: EFC1B430B002029FEB599B65C854B6ABFE6AF89204F148469E6079B3E1DF75DC05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 063A48B8 Relevance: 1.8, Strings: 1, Instructions: 590
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+ ,n^, xrefs: 063A4DA7

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: + ,n^
API String ID: 0-526574387
Opcode ID: e6101bdb1c25ae3a0d20ff6582a9788eca1098bbc3a8d9cdf9988bbafe52036c
Instruction ID: b19c9c97ef6f971e6f16523b33bd43d0f6e99bc75fd18a4c78929d9ebdc18071
Opcode Fuzzy Hash: e6101bdb1c25ae3a0d20ff6582a9788eca1098bbc3a8d9cdf9988bbafe52036c
Instruction Fuzzy Hash: 62326934B007018FDB54DF29C588A6ABBF6FF88304B1584A8E506CB762DB70EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0119AE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0119B086

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 810098654f1a82178cd09a7c61ff2f2076c033ec3df20d44f89840a9576de263
Instruction ID: 18b4c8648266532b86acd50813152e0ad7e88aa6b2e7757561fe346e61204326
Opcode Fuzzy Hash: 810098654f1a82178cd09a7c61ff2f2076c033ec3df20d44f89840a9576de263
Instruction Fuzzy Hash: 7D715C70A00B058FEB28DF29E44475ABBF1FF88304F00892DD59ADBA50D775E84ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 01195935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011959F1

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e94bbd28b8133a1306dfcbb956ff8c4ad4536b3254165d01b4cd143dfea36aa5
Instruction ID: 01fee33c38e386d88a1a12f0e6326231e7b56094dc0ac0d334e01cd258a34f42
Opcode Fuzzy Hash: e94bbd28b8133a1306dfcbb956ff8c4ad4536b3254165d01b4cd143dfea36aa5
Instruction Fuzzy Hash: 7641E071D00729CBEB28DFA9C88478DBBB6FF48304F20815AD418BB251DB756946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05050BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05054381

Memory Dump Source

Source File: 00000000.00000002.1397396081.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5050000_3q1lESMAMh.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 58739c9abf45420a081d8600e24b3904d537af12276818d4b6a9d9313ab1d1f9
Instruction ID: 354bb0b360426282cc9673dc16919fabbc725a811f9831daf64d96bee9c3914b
Opcode Fuzzy Hash: 58739c9abf45420a081d8600e24b3904d537af12276818d4b6a9d9313ab1d1f9
Instruction Fuzzy Hash: 63412AB49003099FDB14CF99D488AAFBBF6FF88324F248559D519AB321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01194248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011959F1

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bff8d4c6814911b37318bae3ddf9aa5b60c9478eb6125eb2200e3e1be9567108
Instruction ID: d236a6f45231aa6699f836a8f201804e7801908080e9923cc5b55816a7a12136
Opcode Fuzzy Hash: bff8d4c6814911b37318bae3ddf9aa5b60c9478eb6125eb2200e3e1be9567108
Instruction Fuzzy Hash: 4F41E170D00719CBEB29DFA9C844B9DBBB6FF49314F20806AD418BB250DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0119C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0119D2C6,?,?,?,?,?), ref: 0119D387

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a98e93cd6efa4ef7d2559ebee6147021758aabc70249b9450b060fe779da57cb
Instruction ID: 355124fb81818a013f729f14f2fe3df0f979c5a284f959da86ff014fa4289635
Opcode Fuzzy Hash: a98e93cd6efa4ef7d2559ebee6147021758aabc70249b9450b060fe779da57cb
Instruction Fuzzy Hash: 7521E3B5D00348AFDB10CF9AD985ADEFBF5EB48310F14801AE918A3350D378A951CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08729420 Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0872AACD

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 086dc757f1562062d02cde151e8403dfc5bfa72e18b958798eca569bedd78b89
Instruction ID: d93f695d36bf0459e65bf4a30978ad30f962eccbd1fefb89096dda653d007ab1
Opcode Fuzzy Hash: 086dc757f1562062d02cde151e8403dfc5bfa72e18b958798eca569bedd78b89
Instruction Fuzzy Hash: 982149B1C04369CFDB10DFA9C895BDEBFF4EF48210F14805AD454A7241C378A548CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0119D2F9 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0119D2C6,?,?,?,?,?), ref: 0119D387

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f1249167969721be89cb44b3dfc90e5a7eabb7d220043a40bfd44f108df37703
Instruction ID: 2ee9503b49b9ab3750f9acab55be938e434479b85fe2f30f300da92dca780365
Opcode Fuzzy Hash: f1249167969721be89cb44b3dfc90e5a7eabb7d220043a40bfd44f108df37703
Instruction Fuzzy Hash: 6A21E3B5D00209DFDB10CF99E581ADEBBF5FB48310F24801AE918A3250C378A951CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0119B2A0 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0119B101,00000800,00000000,00000000), ref: 0119B312

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d31d9d6ae3a2eef688fc2125ac2897ec7bb696ec3929f1f0d2bceade5312011b
Instruction ID: 2ecf58410c696b4725211628c3b0ea200baa2a47d42cab987b7a6bd3a7c43ce4
Opcode Fuzzy Hash: d31d9d6ae3a2eef688fc2125ac2897ec7bb696ec3929f1f0d2bceade5312011b
Instruction Fuzzy Hash: 0D1114B6D043498FDB14CFAAD844ADEFBF4EB88310F11842AD929A7640C775A546CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0119A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0119B101,00000800,00000000,00000000), ref: 0119B312

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3149505773e744a07fb47c83d92bb3f81d1426015c66b5c32667d1bad85d6d64
Instruction ID: 742a4aaa86e43dddf457e6a1dc432226cba7b7cfafcd1c4e5d9528a9c6583f1a
Opcode Fuzzy Hash: 3149505773e744a07fb47c83d92bb3f81d1426015c66b5c32667d1bad85d6d64
Instruction Fuzzy Hash: A41114B6C043499FDB24CF9AD844A9EFBF4EB48310F10842ED929A7240C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0119B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0119B086

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 054d17acf5175fc52572a374de8a10fffda33fd4d75c75d6d51ba544cdd7cfb9
Instruction ID: fa4212b5f4543e80396c509690c411410658b60b45bbd8abecd0506748829e15
Opcode Fuzzy Hash: 054d17acf5175fc52572a374de8a10fffda33fd4d75c75d6d51ba544cdd7cfb9
Instruction Fuzzy Hash: C41102B5C003498FDB24DF9AD845A9EFBF4EB48210F14841AD428A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 087294B8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0872AACD

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bd64b05a212cd0b7a044f94f4ca86cd1d0919fc9c455af477f6e24826e103abf
Instruction ID: 7f6399a2f27c6471312c65cc18deb67667bc55243fce0e05a1ca020b0dbe09dc
Opcode Fuzzy Hash: bd64b05a212cd0b7a044f94f4ca86cd1d0919fc9c455af477f6e24826e103abf
Instruction Fuzzy Hash: 6C11E0B5800359DFDB20DF9AD985BDEFBF8EB48320F20845AE518A7240C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0872AA68 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0872AACD

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 331ef649ceb5c77512f8443a2899e2b6876bd784ccfb4a3ad7038f01d561725a
Instruction ID: 9efe2bf722b7297929fa0b94ef00494a2fc95f4419c11985172b18858c47c402
Opcode Fuzzy Hash: 331ef649ceb5c77512f8443a2899e2b6876bd784ccfb4a3ad7038f01d561725a
Instruction Fuzzy Hash: 2911E0B9800359CFDB10DF99D985BDEFBF4EB48320F20885AD518A7640C379A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 063A59D8 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

d, xrefs: 063A5C29

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: d5719727d2efe4488b6abe486bda9e7b27fbad4f3e540e652f53cbe389269331
Instruction ID: 828676a1d21d34e2197d845b27ce0b23448a5a2e5e117ae74b5ddc2c6ae32c6d
Opcode Fuzzy Hash: d5719727d2efe4488b6abe486bda9e7b27fbad4f3e540e652f53cbe389269331
Instruction Fuzzy Hash: 77C15C34A00706CFC724CF28C48096ABBF2FF89320B5ACA59D55A8B665D730FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 063A48A8 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

+ ,n^, xrefs: 063A4DA7

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: + ,n^
API String ID: 0-526574387
Opcode ID: c6749dfcbe18c07f6f6cd078c461e80e3c9f607de8c4c27537aaa78bd64fbc01
Instruction ID: b9a78bae35fb59b2f11b05d3bbfb2efa7a4ca304b34f3da4726a9d2fbdc97e37
Opcode Fuzzy Hash: c6749dfcbe18c07f6f6cd078c461e80e3c9f607de8c4c27537aaa78bd64fbc01
Instruction Fuzzy Hash: 70B12638B006048FDB54DF39D988A6ABBF6FF89305B1540A8E446DB366DB70ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06391BA0 Relevance: 1.5, Instructions: 1451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9431cd71625c4e2c406cff0748aa316afc10cbe8cbbd912458da22a6b6ab9e4
Instruction ID: 9d3181342bb879236a20db1216c05cfb06e77a45456648195d44444c5e7779ea
Opcode Fuzzy Hash: a9431cd71625c4e2c406cff0748aa316afc10cbe8cbbd912458da22a6b6ab9e4
Instruction Fuzzy Hash: BBC24070E102189FDB559F64C850F9EBBB6EF88704F108099E60AAB3A1DB71ED45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 063A3DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4'q, xrefs: 063A3F25

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 4ca3b8a4623009712dd60a3ab633f01a366f8ae52adb0e1791d625ca5376d7b7
Instruction ID: c4c23db87cd239161a4654a798f6d03e075adda54b3189ca874fb6fa82f23438
Opcode Fuzzy Hash: 4ca3b8a4623009712dd60a3ab633f01a366f8ae52adb0e1791d625ca5376d7b7
Instruction Fuzzy Hash: BF31E132B003104FD729A768A450AAE77E6DFCA22175948AAE449CF740DE34EC0BC7E5

Uniqueness

Uniqueness Score: -1.00%

Function 063A84D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'q, xrefs: 063A85B1

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 4942cfff828c1800e6a109e38dbcfc73fa9664699a644b9cb2822cb2b98c93fb
Instruction ID: 3fdaa1f7601883886d62e35da752ccb3603ee9b0fe00a8e828b6f7d415c8c4a1
Opcode Fuzzy Hash: 4942cfff828c1800e6a109e38dbcfc73fa9664699a644b9cb2822cb2b98c93fb
Instruction Fuzzy Hash: 35317F31B003159FCB18EB7DA4556BF7AE7ABC82017544539E50ACB384EE39EC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 063A84C8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'q, xrefs: 063A85B1

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: fb8e8a7a9a77e4468f04db9144cfed4da230bea456089a64260390c1f18d4f7d
Instruction ID: 655d50f45f4877da078dbf8a326abfbd17dd957d544a255a3efbd2a1fd3fd11c
Opcode Fuzzy Hash: fb8e8a7a9a77e4468f04db9144cfed4da230bea456089a64260390c1f18d4f7d
Instruction Fuzzy Hash: E5216D30B003168FCB59AB7DA46567F3AE3ABC8205754453DA50BDB384EE78EC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 063AB358 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4'q, xrefs: 063AB399

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 686840a4f67b3e83e42f0bf4f26c9f54f27f5ce87acb1e4145a9d09594c63f45
Instruction ID: 472c783356bb34f3dc4b9d1471d418a05cfc8863cb51c91bb71c3fb5dee26bc6
Opcode Fuzzy Hash: 686840a4f67b3e83e42f0bf4f26c9f54f27f5ce87acb1e4145a9d09594c63f45
Instruction Fuzzy Hash: 06012438905389AFCB01EFB8E49899CBFB1FF05200B144199D5C18B302EB305E45CB11

Uniqueness

Uniqueness Score: -1.00%

Function 063A3EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'q, xrefs: 063A3F25

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: dc5729489aab05db7db8e135021c2ef5ff436e2b49cf903cfa788f8af8495789
Instruction ID: 376799c621e2d94bb83fa18a1cc5c57cc76392458c92091ea83664437c29f203
Opcode Fuzzy Hash: dc5729489aab05db7db8e135021c2ef5ff436e2b49cf903cfa788f8af8495789
Instruction Fuzzy Hash: 69F090357002014FC668FB69E850A6F77E6EBC92113548A28E44A8F704EF30BD0B87E5

Uniqueness

Uniqueness Score: -1.00%

Function 063AB368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'q, xrefs: 063AB399

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 78cac89c36d37bb03440113cc61fa8b4e88b2ccccac405cf326a0b82935c0831
Instruction ID: 88513a7644c7a0bfc36ce31d3ccd8bd5c7edd8fecbb35d628f742fd1847a908d
Opcode Fuzzy Hash: 78cac89c36d37bb03440113cc61fa8b4e88b2ccccac405cf326a0b82935c0831
Instruction Fuzzy Hash: F0F0AF74E01209EFCB44EFB8E59899CBFB2FF44204B1442A8D9469B305EB30AE44CB45

Uniqueness

Uniqueness Score: -1.00%

Function 06393838 Relevance: .8, Instructions: 782COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e37481f37b4d45031b616c5c2b6eddc1c145803bac1d44c2e72cf6919ea47ec
Instruction ID: d74110a7d252de11a47e5687b3d6c74b6ba730a930e006f3d3c64fe8cadcfa60
Opcode Fuzzy Hash: 0e37481f37b4d45031b616c5c2b6eddc1c145803bac1d44c2e72cf6919ea47ec
Instruction Fuzzy Hash: 75621974B002049FDB54DF69C894E6EBBF6EF89704F108099E606DB3A1DA71ED458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 063900D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc05ef196b2991b4ce4cfbe1599ccdd384e52a5ccd33e4f2e8fa4a860268e9f
Instruction ID: 3fe4dfd9827014d5db712465b70182133aa8ebb6fc68c5fe85284bf3b4976f16
Opcode Fuzzy Hash: bcc05ef196b2991b4ce4cfbe1599ccdd384e52a5ccd33e4f2e8fa4a860268e9f
Instruction Fuzzy Hash: 6E429C30B007148FEB68AF74D854A2EBAB2FFC5204B505A5CD5079F7A4CB79EC068B95

Uniqueness

Uniqueness Score: -1.00%

Function 06390597 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2bbd25c01b9d59e203304519c6e64626d6d7da6b379f091fb1c260746b196f
Instruction ID: b645a848465712a900ad1bf71a3cd5f4a0760f0b82524cd02b25be40f024bd3a
Opcode Fuzzy Hash: 5c2bbd25c01b9d59e203304519c6e64626d6d7da6b379f091fb1c260746b196f
Instruction Fuzzy Hash: 16028D34B103148FEB689B74D854B2EBBB2BF85604F50495CD6079F3A1CB79EC068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0639060F Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f886a44f21ff0871593ef533ff8795d4e9b944524de4b3151d2919a5b7f029
Instruction ID: 5a4f3c0eeeb824e40e603e186468bbe2b4c2a5fe926359ff96508f6cdf29759e
Opcode Fuzzy Hash: f4f886a44f21ff0871593ef533ff8795d4e9b944524de4b3151d2919a5b7f029
Instruction Fuzzy Hash: 3C027D34B103148FEB589B74D854B2E7AA2FF89604F50845DD6069F3A1CB79EC068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 06390000 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b4060930becb5c6d287a3b041a9acdd269fa008be4053042aeaeef28c2f161
Instruction ID: 0a81d8c613d4f7c19614a9250db0845035905ca2660c43e085d24e460ff86a4e
Opcode Fuzzy Hash: 41b4060930becb5c6d287a3b041a9acdd269fa008be4053042aeaeef28c2f161
Instruction Fuzzy Hash: 48E19234B003049FEB599B74C858B297FB6AF8A604F14809AE606DB3E1CB75DC45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06390687 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9668f728b845b1a6920d843f6aba833b5dfebeebc08e186586e3106e04988c78
Instruction ID: 6cd1584097bc713e47139c9c0d004b79e28e9726c16439b1bf7ab6b34388b40a
Opcode Fuzzy Hash: 9668f728b845b1a6920d843f6aba833b5dfebeebc08e186586e3106e04988c78
Instruction Fuzzy Hash: B8E19C34B103048FEB589B74D858B297BA6FF89704F50845DDA069B3A1CB79EC06CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 063906FF Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2365ec7cfb05d23b8088f24fc679c687963d9cbafc4bad3db4732bb91ba4dde2
Instruction ID: c694d32fb3851c8aecd4f693f9aa60332f1a85b70009a425e38127582993ee2a
Opcode Fuzzy Hash: 2365ec7cfb05d23b8088f24fc679c687963d9cbafc4bad3db4732bb91ba4dde2
Instruction Fuzzy Hash: 19D19D34B103048FEB589B74C858B297AA6FF89704F50845DEA069B3A1CB79EC45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 063900C4 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7dce716860c2f418cf17fe2fb4ebef773b4bdca726902337f7a7f3ee4354654
Instruction ID: d722a2aa60db12a41163f4922c64f169920130c943a817340e33df5dd318d127
Opcode Fuzzy Hash: a7dce716860c2f418cf17fe2fb4ebef773b4bdca726902337f7a7f3ee4354654
Instruction Fuzzy Hash: 41C19E34B102049FEF589B74C859B297BA6FF89704F14806AEA069B3E1CB75DC45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 063A7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2526dee740e4a05c9047070d64336bc9295d18a9d53445aef144394729eaa81
Instruction ID: 326f6c41f4d3b7bba90a2ac1c991d8e208929e8f12e7ac0a113d7dee195b43e2
Opcode Fuzzy Hash: f2526dee740e4a05c9047070d64336bc9295d18a9d53445aef144394729eaa81
Instruction Fuzzy Hash: D2511375E003589FDB64CFA9D885BDEBBF6EF88300F248529D415AB284DB749946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 063934D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d97f14945f07526d75f0adee9d8bc7bf1ea7b7c1dc946bbe42e1238a387b40
Instruction ID: 43f7d685c454b3b5071a34d2eec966d2e69e99904e683b895310f7f5f279d1aa
Opcode Fuzzy Hash: 25d97f14945f07526d75f0adee9d8bc7bf1ea7b7c1dc946bbe42e1238a387b40
Instruction Fuzzy Hash: EE513A35B106159FDB54DF69C884A9EBBF2EF8D314B118069E906EB361DB31EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06392FC8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff95551134c4fe1d4bcda226d03a63cea45e1588cac2f50cd5eaab68a80d42f4
Instruction ID: 7172d9fdf1b20a692e776d181df1345ead7b02a0b192dd3e78ea42db53a8e5b8
Opcode Fuzzy Hash: ff95551134c4fe1d4bcda226d03a63cea45e1588cac2f50cd5eaab68a80d42f4
Instruction Fuzzy Hash: FE513B35B102149FDB54DF69C884A9EBBF2FF89310B118069E906EB361DB71ED05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 063A7D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2646dcf685f0b1d289ec677834f94f33b769418636e42876df9fdaca3bf297
Instruction ID: 5aafce488c7dcd6ae565947cab1106bbb530bfe89e7241f04893e5411748d445
Opcode Fuzzy Hash: fb2646dcf685f0b1d289ec677834f94f33b769418636e42876df9fdaca3bf297
Instruction Fuzzy Hash: 425135B5E003589FDB64CFA9C985BDEBBF5EF48300F148529E415AB284DB749946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 063AE8B0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a7728eee6aec2ee786402f6fe65a0407f44d81ace8a1c5f791b79f5b017b58
Instruction ID: a451b0ce8e02a04cb71f7c832bbae1a2ab54cc1e4453ddfde19898dce63ea2bd
Opcode Fuzzy Hash: 49a7728eee6aec2ee786402f6fe65a0407f44d81ace8a1c5f791b79f5b017b58
Instruction Fuzzy Hash: 0D41F235A043448FCB559F74D5246AD7FB2EF86310B1489AEE484CF362DA398D06EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 063A59C8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88664f252f635cf62b98609b390300bc38cc2d8cba740f4d642a7e754004abc5
Instruction ID: eca8469765367c5532d0ee8bc576a4b07c80835c960a2870b4841c6502e45341
Opcode Fuzzy Hash: 88664f252f635cf62b98609b390300bc38cc2d8cba740f4d642a7e754004abc5
Instruction Fuzzy Hash: 93414635A00606DFCB10CF59C880AAABBF2FF89320B19C958E5599B261D730F905DB90

Uniqueness

Uniqueness Score: -1.00%

Function 063A6E90 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48001300f8c1df5b2a8df47dd91c5ecdc2f3445641f1d50dbe5f42b8661af6e
Instruction ID: b27761a363043ebd54811b54891870bef11fda417e08edaa5d22c680333b76f8
Opcode Fuzzy Hash: d48001300f8c1df5b2a8df47dd91c5ecdc2f3445641f1d50dbe5f42b8661af6e
Instruction Fuzzy Hash: D2413776504F948FC726CF2AC480987FFF4AF99210B048A6EE5DA87B61D270F905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 063A5579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca0d1e85039ab7803d18037a84ede5a9cfd3902a880c002dcc3295052143510
Instruction ID: 7572b90a06f1e834cc6390099c7a4d1b8f8017eecfac27eec63bd4885f8e12ad
Opcode Fuzzy Hash: bca0d1e85039ab7803d18037a84ede5a9cfd3902a880c002dcc3295052143510
Instruction Fuzzy Hash: 18314239B00310AFCB15DF34D884A6ABBA6EF89211B548468E905CB365DB30ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 063A5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717e5316661ad51d3f7d01a3180a2236faafde81204f3b3db5ad71794a55ecb1
Instruction ID: 9caec892805338adc3e2edaf8855a96e4194136be918a68bda6231bacbb24fe1
Opcode Fuzzy Hash: 717e5316661ad51d3f7d01a3180a2236faafde81204f3b3db5ad71794a55ecb1
Instruction Fuzzy Hash: F5314274B00310AFCB15DF34D884A6EBBA6FF89311B548469E906CB365DB30ED06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 063A87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5a5e2fccb93fb913f40ef94503952fb96b570cc5e79605a700684fae3365e4
Instruction ID: 59c4c92dd95dc882863ba2cd2f1fe61f8e75db3484332b0ed319ac2df537eace
Opcode Fuzzy Hash: 6d5a5e2fccb93fb913f40ef94503952fb96b570cc5e79605a700684fae3365e4
Instruction Fuzzy Hash: 2441E2B1D013489FDB54DFAAD944ADEFBBAEF88310F10802AD415A7254DB35A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0639105C Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398287074.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6390000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b6849231576a4a020545c71147bf310bd2286aa1d704f1ae22c4a7c99181bf
Instruction ID: ef5947ce509ea19dc2d7bf0905b776b77a68f3340d5671a48e473714053abf36
Opcode Fuzzy Hash: 50b6849231576a4a020545c71147bf310bd2286aa1d704f1ae22c4a7c99181bf
Instruction Fuzzy Hash: 8F21F430701241AFDB559B79DD009ABBBFAFFC621071485AAE416DB6A6CA30CC14CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 063A8796 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ea7865e6b96028c250e3bc55d986643bbf7742156b2f7aa9ae47a74f7af088
Instruction ID: e1b00eb0c1b211598fd9fd7278821c51219a2c88d65fa68b3b44e439f81fd60f
Opcode Fuzzy Hash: c9ea7865e6b96028c250e3bc55d986643bbf7742156b2f7aa9ae47a74f7af088
Instruction Fuzzy Hash: D231D0B1D012489FDB14DFAAD984BDEBFBAEF88300F24802AD415A7290DB359945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 063A8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa1d67d3dfe1bf651015f2aee0598456f054d5b752869c4eb9987e1ae6dedac
Instruction ID: 7a950dff73f11c8507d474b7a07fbcb32fbcbc3c6625c58c5c488018982c9bc3
Opcode Fuzzy Hash: 7fa1d67d3dfe1bf651015f2aee0598456f054d5b752869c4eb9987e1ae6dedac
Instruction Fuzzy Hash: C63112B1D013489FDB14CFA9D890BDEFBF9EF48310F24852AE405A7240C774A846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010AD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390377917.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b946aa7f86ad2749523ad0cdb275d76f7cde84b03d9edf90843f008df9a5d4a5
Instruction ID: 4aafb666dea8f694b871c3102eae4173b92e823f5b177cdad8769904a2bfc908
Opcode Fuzzy Hash: b946aa7f86ad2749523ad0cdb275d76f7cde84b03d9edf90843f008df9a5d4a5
Instruction Fuzzy Hash: AE213372604300DFDB05DF84D9C0B5ABFA5FB88324F60C1A9E9490F656C736E446CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 010BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390427608.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a243ee57b3d82f7a1a0bc720402a19f90cd935a46374a96c47be9cc2b78b6b
Instruction ID: b2cd2254df9ad1a758c3ca8b072c03c70061d06639af11a8362719485a2fe977
Opcode Fuzzy Hash: d9a243ee57b3d82f7a1a0bc720402a19f90cd935a46374a96c47be9cc2b78b6b
Instruction Fuzzy Hash: 08210375614300DFDB15DF54D9C4B56FBA1EB84318F20C5ADE8890B246C336D407CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390427608.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54de2308fa4d3231fa34fe90a21b1704fe48c9fdd284fddab12d35ffa3d9594
Instruction ID: abf4ea8b98085f3a23aacdc4af0dc9050fea9b1c9877d44230638ad8b6480ac5
Opcode Fuzzy Hash: c54de2308fa4d3231fa34fe90a21b1704fe48c9fdd284fddab12d35ffa3d9594
Instruction Fuzzy Hash: A32153755083809FCB16CF54D9D4711BFB1EB46314F28C5DAD8898F2A7C33A9856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 063A8A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ae6dd1e882873e9d597c537f8a5a5db2bf8c9accd1524a1aa9a8cedd4d8676
Instruction ID: f4877149968ba5aafec60c922019251a659d58c34556ae0a29fabbbcaa5388d3
Opcode Fuzzy Hash: 15ae6dd1e882873e9d597c537f8a5a5db2bf8c9accd1524a1aa9a8cedd4d8676
Instruction Fuzzy Hash: 7B2103B1D01348DFDB24CFA9C995B9EBBF9EF08300F24852AE405A7390D774A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010AD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390377917.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: ed76d812b898e6b1f2d110270225e44dce35ffbec55e321634bc7c836fd38c3a
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: CD11E176504240CFDB06CF84D5C4B56BFB2FB84324F24C2A9D8490B657C33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 063ABC5F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b071f423e5f0d66aa04011621d873c38e8bcf97df3baa2ba11822617628b7273
Instruction ID: 1e5176ebd4da7e25a01a323329454d6ec5a9656f59d21ce941184e5a8be428fd
Opcode Fuzzy Hash: b071f423e5f0d66aa04011621d873c38e8bcf97df3baa2ba11822617628b7273
Instruction Fuzzy Hash: F611E134200301CFC395AB74A8609BE7BA3EEC11A1354591DD287DF600DE36BC0B8792

Uniqueness

Uniqueness Score: -1.00%

Function 063A8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1921abef440e9b212237d71380e4ee2ab17744b57fd14e2dcb7ea80cd8c203
Instruction ID: 0d31efae5662f26ee5c883d40590c8e6438fc5edc0a9d7fd5e56d13782115c58
Opcode Fuzzy Hash: 2c1921abef440e9b212237d71380e4ee2ab17744b57fd14e2dcb7ea80cd8c203
Instruction Fuzzy Hash: 38018471B1021AABDF10DEA9EC44ABFFBFAEBC4251B144136E505D3240DF30A91597A1

Uniqueness

Uniqueness Score: -1.00%

Function 063AC499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59eef3fd916d767b5b5529f9d1a7d3f52687833016bc1ac3909baf7907e3fe2f
Instruction ID: 51a2d64b96b380575f7c9b60e16db1784090641358b27dc7541914daaec1f73c
Opcode Fuzzy Hash: 59eef3fd916d767b5b5529f9d1a7d3f52687833016bc1ac3909baf7907e3fe2f
Instruction Fuzzy Hash: 4611E5346043408FD325AF74D05465E7FE3EFCA211B108A2DD1CB8B645CF74A80A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 063ABC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b962c12abf1d337217e5d9f02af0055e962d27b6db514abb24d145642537fde
Instruction ID: 3256dbdf5221fac464388935feb690ff726a94e3a1e0165e478c4186e5ae5e9f
Opcode Fuzzy Hash: 2b962c12abf1d337217e5d9f02af0055e962d27b6db514abb24d145642537fde
Instruction Fuzzy Hash: 0301B131200206CBC6D4A7B4E46496E7AA3FEC01A1784492CE247CF600DD36BC4F8792

Uniqueness

Uniqueness Score: -1.00%

Function 010ADB09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390377917.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd987a8b1bb1d2b274f638f458531eeb29d24635ef14795724871743172ed519
Instruction ID: a868046f8792da5a4f317574335754e3132f4d2a6c4f970442ac6c5718df6cfa
Opcode Fuzzy Hash: cd987a8b1bb1d2b274f638f458531eeb29d24635ef14795724871743172ed519
Instruction Fuzzy Hash: 0801F771114340DEE7214AD9DC84B66FFD8DF41721F58C55AED890FA82C238D840CB76

Uniqueness

Uniqueness Score: -1.00%

Function 063AC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17b767a6b2f8d8984c58fd5a583ceb0aa38a014369f093aba5c7a208d75f4ae
Instruction ID: 0fddbe4d3c069e3f9c00ebd32d6dcb3cd79ca3aba3f0a62edb8c99bb038a8d6e
Opcode Fuzzy Hash: d17b767a6b2f8d8984c58fd5a583ceb0aa38a014369f093aba5c7a208d75f4ae
Instruction Fuzzy Hash: 74019E346003058FD324AF65E05865E7BE3FBC9316B108A2DD18B8B644CF78A80A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 063A5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1b04cc8ff0b300dd0a3c376815be3720dce40ff80337c6014186b28a2cf816
Instruction ID: 71419ff2d31af9ec89e71957c826d82798a00fe54099a6a586c1b9b18f18a825
Opcode Fuzzy Hash: 5f1b04cc8ff0b300dd0a3c376815be3720dce40ff80337c6014186b28a2cf816
Instruction Fuzzy Hash: 36018634A11711CFDBA99A35E404527B7F7FF84225714982CE40786914DA75E485DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 063A8F42 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8ebc7cb66743cfd35e8d0388d0439afdc66170bd487c38214afa7cec4f6362
Instruction ID: fae4b87050897148646424701597e624b04f11c9bff9ac92c4ae6ca1f4f2745e
Opcode Fuzzy Hash: 7c8ebc7cb66743cfd35e8d0388d0439afdc66170bd487c38214afa7cec4f6362
Instruction Fuzzy Hash: 800100B4D0420AEFDB40DFA8E9457AEBBF4EB08300F2080A9D819A3380E3745A40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 063A8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34ea8ecfc87062ccef5d125830b4318f7a7687a4cd79a55113a8945c77683ab
Instruction ID: 06be5f46ffa4a8e8293c0e3e4c8a3e36a645e20a2409f3a56c047a278541aaca
Opcode Fuzzy Hash: f34ea8ecfc87062ccef5d125830b4318f7a7687a4cd79a55113a8945c77683ab
Instruction Fuzzy Hash: 5D01C0B4D0420AEFDB44DFA9E9446AEFBF5FB49301F1080AA9815A3340E7780A44DF90

Uniqueness

Uniqueness Score: -1.00%

Function 010ADB08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390377917.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad64609ffe5415c26026f4b4bb3878ac8bfb0996b32695b5f24436a812b25bab
Instruction ID: 6fd7f1ca10bc74dc52b7efe73868ce90d3f8fbd7ef7fc056e455fd36b753d947
Opcode Fuzzy Hash: ad64609ffe5415c26026f4b4bb3878ac8bfb0996b32695b5f24436a812b25bab
Instruction Fuzzy Hash: 8CF0C272004340DEE7218E4ADC84B62FFE8EB40734F18C19AED480B682C279A840CB71

Uniqueness

Uniqueness Score: -1.00%

Function 063A6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1a7b66b05d05741e59052122ea642540ad47ed3939c548b7e43714164ba336
Instruction ID: dcb457b1415302fdd120523bdc1d93483a6d97b5ec3ec3910c4b6e36bac308a8
Opcode Fuzzy Hash: 4e1a7b66b05d05741e59052122ea642540ad47ed3939c548b7e43714164ba336
Instruction Fuzzy Hash: CAF037773041E83F8B514E9A5C10CFB7FEDDA8E161B484156FED8D6141C429C921ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 063A67C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7107ef5198d306a1331cd8293dd508f156f5d8ded74fb32b68ac06daee7721fa
Instruction ID: 74ed310132f1ce921ecfbb19d37709e64b835db77c4bde21e95f42e231782ed4
Opcode Fuzzy Hash: 7107ef5198d306a1331cd8293dd508f156f5d8ded74fb32b68ac06daee7721fa
Instruction Fuzzy Hash: E2F09031B043009BD7209A64DC46F567FE9EB46725F188166F664CF1E2D6A1E8099780

Uniqueness

Uniqueness Score: -1.00%

Function 063AC110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00224bd1ba3b4432fb20c2192ecd293652c63952351e3166cbbb71f1e77c7c0
Instruction ID: 7d7a7d5f1a973890715ed03a803349dd108b7171adc9764ecffc4a90c1bafe52
Opcode Fuzzy Hash: d00224bd1ba3b4432fb20c2192ecd293652c63952351e3166cbbb71f1e77c7c0
Instruction Fuzzy Hash: 17F0BB302097D04FC322AB38E85879E7FF6DF82214B08059EE1C6CF653CA756909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 063AC170 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71cd97e0621c375c139abcbc231bccdf0003a81462d05b8e32593e89c2cbc5d
Instruction ID: 9cf13a11fe8bfb382bfb1cbe781c3b8520434f5fec11cd13c5f8d295fff8b055
Opcode Fuzzy Hash: a71cd97e0621c375c139abcbc231bccdf0003a81462d05b8e32593e89c2cbc5d
Instruction Fuzzy Hash: 3501DC35405B408FD766DF25E598261BFF2FF893113048A1ED4CA83A51DB34A50ACF80

Uniqueness

Uniqueness Score: -1.00%

Function 063A8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5d74d75e3299eecab597049ce9487919e81565406b44bd5dcdfd5772ec4c5c
Instruction ID: 661855a11398a15f51bef9af8a21081dc03f09cadb6274333e319a189a309756
Opcode Fuzzy Hash: 8e5d74d75e3299eecab597049ce9487919e81565406b44bd5dcdfd5772ec4c5c
Instruction Fuzzy Hash: 6DF0CDB4D0824ADFDB00CFA0E8141ADBFB8EF5A201F0041CAE446EB350E2394A01EB80

Uniqueness

Uniqueness Score: -1.00%

Function 063A8341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b45e99908a1abc0c2e6168cfe9e782297970e7dbb732ff6dcff4156c3789ea7
Instruction ID: f5fa886c52ead8111bf9914431d7e2271be2dc1a0291ea505814f9e754eee62e
Opcode Fuzzy Hash: 5b45e99908a1abc0c2e6168cfe9e782297970e7dbb732ff6dcff4156c3789ea7
Instruction Fuzzy Hash: AFF0A732F1411A5B9B1099699C459BF7BFDEB941557080136E914D3140FB30980987A1

Uniqueness

Uniqueness Score: -1.00%

Function 063AACB8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524f09ddcd27c8264e9691de11e16bbf18567883b8e02424c91de7931f7955a1
Instruction ID: 6fa1df6b55a532118acc2cca681911759b76bc5a8c9bc545c74bbc16ffaddb7d
Opcode Fuzzy Hash: 524f09ddcd27c8264e9691de11e16bbf18567883b8e02424c91de7931f7955a1
Instruction Fuzzy Hash: C8F0E2B6A092608FC7671B64A8340AD3F69ED8616234844CFD2C7CF151DA64490BC3E2

Uniqueness

Uniqueness Score: -1.00%

Function 063A54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee0a9b1a4dab59f05ce84c913c2db9928426573c16f693204185635b63a39fb
Instruction ID: 33aa01789249286fd51b8237808cb72ce6e9055bf46823cce1d5af3c3d97243f
Opcode Fuzzy Hash: 8ee0a9b1a4dab59f05ce84c913c2db9928426573c16f693204185635b63a39fb
Instruction Fuzzy Hash: B5F024319007018FDBA8CE21D50076BBBF6FF80325F48886CE44746915C675F449DB80

Uniqueness

Uniqueness Score: -1.00%

Function 063AADE9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21f0b8bec678d1e40a0319b698fe055b52d467cdb7a2202a467eeb2ba906e2c
Instruction ID: 26f78ae0b9baa0cf19452053c8f50b7b86cc7983f381e239e8391551a53e42ef
Opcode Fuzzy Hash: f21f0b8bec678d1e40a0319b698fe055b52d467cdb7a2202a467eeb2ba906e2c
Instruction Fuzzy Hash: 91F05C312002419FC3641BA8E4647EFBFEAFF8A251F00492DE28ECB242C97118468765

Uniqueness

Uniqueness Score: -1.00%

Function 063AADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0889b6dca9c050189d60a2c116eb143e94fe6d70932670a4209e4cd50ad6c8a4
Instruction ID: 29f4d001a17afe1ac088f6e22dd8c70e75e1fad0c8e6f9b627e27387edeb8487
Opcode Fuzzy Hash: 0889b6dca9c050189d60a2c116eb143e94fe6d70932670a4209e4cd50ad6c8a4
Instruction Fuzzy Hash: C1E04831301211AFC7546B9AE498A9FBBEEEFCA761B40452DF30ECB241CE75680947B5

Uniqueness

Uniqueness Score: -1.00%

Function 063AC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b3bd8c26a4aff2efd19ec531892c1eb832f9d10c50261dc21412a5e326cd8a
Instruction ID: 86d7244de10b74efc2bc90e32fe9dc9508a275dc0d9d3a7b0d0d4ee330adcf60
Opcode Fuzzy Hash: e5b3bd8c26a4aff2efd19ec531892c1eb832f9d10c50261dc21412a5e326cd8a
Instruction Fuzzy Hash: 29F09A34500B018FD725EF2AE448612BBF6FB88315700C62EE98B83A50DB74A50ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 063AAC60 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e2838b70a87d871d408450eb04b83ee9b4156b31f8675daf57f7d599927041
Instruction ID: 57adfff222f8e7474a302c997228f2e827c88b8b0a6848ff6725e10f9647b6f0
Opcode Fuzzy Hash: 65e2838b70a87d871d408450eb04b83ee9b4156b31f8675daf57f7d599927041
Instruction Fuzzy Hash: B8F0A076A093A04FD7275B34A8340ED3F6A9E8612530904CBD686CF182CE24090AC7EA

Uniqueness

Uniqueness Score: -1.00%

Function 063AB500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a658f8491a8bfebc5aa5d91deb60f5e9e9aa2fb51b1286197a7b10b70f380f
Instruction ID: efc554214ab4b38150f128a6d7c0acfde1221c6968e249105a44675a5aa416a6
Opcode Fuzzy Hash: c8a658f8491a8bfebc5aa5d91deb60f5e9e9aa2fb51b1286197a7b10b70f380f
Instruction Fuzzy Hash: 96F01535D0120CAFCB01DFB4D9488CDBBB9EF44300F1082AAE985E3240EA345B55DB92

Uniqueness

Uniqueness Score: -1.00%

Function 063AC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7065b716ba625d7c2ae4037f3cfcdc5d2a6f451ae9657c5a3457479657324b5
Instruction ID: 8c418ea95382e8568b7ed9043b31400c1a3b0f5f06b3f4bf4078403eefa3786b
Opcode Fuzzy Hash: e7065b716ba625d7c2ae4037f3cfcdc5d2a6f451ae9657c5a3457479657324b5
Instruction Fuzzy Hash: 25E065306047514FC721A769E458B9F7BE6DF85215F04052DE286CB642CBB5B80A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 063ACC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dca7fac2cc0b43b8fe1b1c3d4a4d85bac8bb41d42b7f494c2017d9d9c3687b5
Instruction ID: a3dc70ee7717b6cdd751dfd3271687899ffdf49cd8a77a2e1f8a779b921823ff
Opcode Fuzzy Hash: 4dca7fac2cc0b43b8fe1b1c3d4a4d85bac8bb41d42b7f494c2017d9d9c3687b5
Instruction Fuzzy Hash: DAE0D8395052904FC712BF28F8109EABFB0FF57114B005256D1C0C7A16C730080B9BD6

Uniqueness

Uniqueness Score: -1.00%

Function 063A5698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3dfa83099ddf863cd7a9feac4ca2bfe4a8f71891ce4c8996ca621b603968f3b
Instruction ID: c39570185e4109ebdb9dc45976f449537659dd7643a25687a58a067c5853a558
Opcode Fuzzy Hash: e3dfa83099ddf863cd7a9feac4ca2bfe4a8f71891ce4c8996ca621b603968f3b
Instruction Fuzzy Hash: 56E04FB211D3454FD3059A64E9095876B98EB62324F518CBEE0408A096E635D457C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 063ACE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561ad8dd0fd47db6a9b697926d0615b744bc116074767332cbbdceec33f6c1c4
Instruction ID: 2f76ffc9b63a763d4ae67290851ef0a7769069884665c1909dbb90b748fb1eab
Opcode Fuzzy Hash: 561ad8dd0fd47db6a9b697926d0615b744bc116074767332cbbdceec33f6c1c4
Instruction Fuzzy Hash: B0E0D878509391EFC752BB20B5145AA3FB0FF025187005499D8C08BA05C7304C46D7D6

Uniqueness

Uniqueness Score: -1.00%

Function 063AE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a535fe1f19482812eb652db9c828be7f2fb65bc71c4bb6d419104467258ac9a
Instruction ID: b523e7dabb50cef324e6d94eb56ff420a7017e5e8c0fe69013fb9bfc35594232
Opcode Fuzzy Hash: 1a535fe1f19482812eb652db9c828be7f2fb65bc71c4bb6d419104467258ac9a
Instruction Fuzzy Hash: C0E0D871909204FFCB41CB64A8508ED3BB1EF4611172042DAD805D7251D5301F158751

Uniqueness

Uniqueness Score: -1.00%

Function 063AAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0239333ad842e87c893f537ae1f85e00d6f94b12dd5cccbbc2d3f223bf4de602
Instruction ID: c0a2b2d025029668bb4c8bfdfb5f5fc44ae50f72057b3aa0a5491e140ca63bcc
Opcode Fuzzy Hash: 0239333ad842e87c893f537ae1f85e00d6f94b12dd5cccbbc2d3f223bf4de602
Instruction Fuzzy Hash: 33D05B31710119578A192765F4284AE77AFEAC55723040129E70BCF240CE651D0647D6

Uniqueness

Uniqueness Score: -1.00%

Function 063AB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7aa51de0785a56371835832017230bbfd9e7c6ff1d0bca8de9a53ee8edc194
Instruction ID: c4df6c7971607a85ddf030905c150aecaee9776501a89a00f01e9a68e410cc79
Opcode Fuzzy Hash: dc7aa51de0785a56371835832017230bbfd9e7c6ff1d0bca8de9a53ee8edc194
Instruction Fuzzy Hash: 33E09A75D0020CEFCB40DFE4D5888DDBBB9EB48200F1082A6D945A3200EB345B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 063AE8F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81807b4bd5f202d39a5195674ebfd6a59857a86abdb76a412db68ee409a9a54d
Instruction ID: efc087bbe834ce857a6ac3318cd7643bc2e678fe9c47f3a21e6fc4ec5b8e60cb
Opcode Fuzzy Hash: 81807b4bd5f202d39a5195674ebfd6a59857a86abdb76a412db68ee409a9a54d
Instruction Fuzzy Hash: 4BE05E3D6683808FC7A28F34D5608A57FB1AF4635135944CAE0C08F673C2218D25FF60

Uniqueness

Uniqueness Score: -1.00%

Function 063AE280 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4799add09fe9469ceaa239e1a2cf948f6695119e476918c68773cda27fee74
Instruction ID: 116244f9e557dec31e7a21dee6735f2a130866459aad1c42c2b2630c9e648534
Opcode Fuzzy Hash: 5a4799add09fe9469ceaa239e1a2cf948f6695119e476918c68773cda27fee74
Instruction Fuzzy Hash: 50E086345002128FDA4CFA00FE59A6673B2F74871CF001158D4024BE64CB70198A9BCA

Uniqueness

Uniqueness Score: -1.00%

Function 063AE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89bf9380a4a4822d2acb0554e120fcd778daa41e0c31d6585af8053cfe0956b
Instruction ID: 157ede4c1c48be29d8e5018b21d6a87a14dcbbb037a660efff8eb8a92528603d
Opcode Fuzzy Hash: a89bf9380a4a4822d2acb0554e120fcd778daa41e0c31d6585af8053cfe0956b
Instruction Fuzzy Hash: 79D05E71E0020CFFCB80EFA8E90099EB7B9EB44214B1081ADD609E7600EA316F059B91

Uniqueness

Uniqueness Score: -1.00%

Function 063AF8EA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75431f15f5e0b80f2641e8e53862e1e78fc1e234c54fa4f57d0e77172eb8c05c
Instruction ID: 3ebad351eb896230f01a91cc14a8e6e560037a17453f2b0c252240e2f08e61bd
Opcode Fuzzy Hash: 75431f15f5e0b80f2641e8e53862e1e78fc1e234c54fa4f57d0e77172eb8c05c
Instruction Fuzzy Hash: C5C012B17441100B46A4AA6C702006D7AD796DC1B3395016EE78AC7344CD719C665781

Uniqueness

Uniqueness Score: -1.00%

Function 063A3721 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b480a51272bcd64bafd3dc06de13b137ded05875177606e283da0c4a79ee042
Instruction ID: 859233ec24256e462507da0acc83f944e9a75700d8b02d303cff9f8beb4dbba9
Opcode Fuzzy Hash: 6b480a51272bcd64bafd3dc06de13b137ded05875177606e283da0c4a79ee042
Instruction Fuzzy Hash: C6B012FB91500047C31413005CC2FE3121293B5288F5F2A609559D3341F518D60140A8

Uniqueness

Uniqueness Score: -1.00%

Function 063ADFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56d6cf11e0391a57d9c935332b7e305acc80c7b04a82d9f3903faf74e74e094
Instruction ID: cce250c71105a77d3806b028e7d3416062ce2f4f0a40c00e6b7dabca7b8db170
Opcode Fuzzy Hash: a56d6cf11e0391a57d9c935332b7e305acc80c7b04a82d9f3903faf74e74e094
Instruction Fuzzy Hash: 46C04C7154B7905EDB065B74980D4847E22AF6671471595CEA6818E062D6610405CB96

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 063A6FE8 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be89bfb99d0aa673fc043de4062c83ba08ad461782c061a4ea03ecd2405cc77
Instruction ID: fd752ad9565416726c853071d707528a80c91b94c74bb3563463a5ce8540eec4
Opcode Fuzzy Hash: 7be89bfb99d0aa673fc043de4062c83ba08ad461782c061a4ea03ecd2405cc77
Instruction Fuzzy Hash: 17621FB07003009FE748EF59D85876A7AE6EB84308F64C95CD0099F395DBB6E90B8BD5

Uniqueness

Uniqueness Score: -1.00%

Function 063A6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe37f54cc26118fb0573a9290442ef481d2ce6da1282c2c131a912ceab23b701
Instruction ID: f4e9c82cee1392e7ac18538a76c230baa398da6ce3de2d3afc809cfb1f1583c9
Opcode Fuzzy Hash: fe37f54cc26118fb0573a9290442ef481d2ce6da1282c2c131a912ceab23b701
Instruction Fuzzy Hash: D6621FB07003009FE748EF59D85876A7AE6EB84308F64C95CD0099F395DBB6E90B8BD5

Uniqueness

Uniqueness Score: -1.00%

Function 05050040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1397396081.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5050000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961ac605881f7a7bdad601e188b95376d382d281f8e20bd2a03f2be7b737dbdd
Instruction ID: 28a922f37d63132bb83c2cf0710512400d4c151c7d9bce2f44f9f802157e502c
Opcode Fuzzy Hash: 961ac605881f7a7bdad601e188b95376d382d281f8e20bd2a03f2be7b737dbdd
Instruction Fuzzy Hash: CA1285B16017458ED3B8CF65E84C19D3FB6B791328B904329D2711A2E9DBB825CBCF48

Uniqueness

Uniqueness Score: -1.00%

Function 08728399 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdd0aae8c1041761d076b99f9076bccf82badcd0272f2735369d8ac488a9a08
Instruction ID: b1cabeffbce1faba0581fd006a253d695368aa1a9bc34d52a4869779eefe0c15
Opcode Fuzzy Hash: 2bdd0aae8c1041761d076b99f9076bccf82badcd0272f2735369d8ac488a9a08
Instruction Fuzzy Hash: EED10675D10B5A8ACB10EFA4D950A99B7B1FF95300F20CB9AD0493B664EF706EC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0119DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b809660312bd9a89037b67228542b95dcb2b3363a977b8e2b3a11fb0b55993
Instruction ID: 898f6010d0ce60a69f914ebe24bd5d6019362e6edc8dbdc2dc344c8f00fc7c4e
Opcode Fuzzy Hash: 71b809660312bd9a89037b67228542b95dcb2b3363a977b8e2b3a11fb0b55993
Instruction Fuzzy Hash: 38A19132E0020A9FCF19DFB8D9405DEBBB2FF84304B1545AAE915EB255DB71E946CB80

Uniqueness

Uniqueness Score: -1.00%

Function 087283A8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeebd9b6444d214212118051e56ab3b29435f4c790d37128f5b89291d50fed8
Instruction ID: 2e7a29077b6712594cd1e39ee0afd19640441c06a0f50e9785d2a1cdf48c4f2f
Opcode Fuzzy Hash: cfeebd9b6444d214212118051e56ab3b29435f4c790d37128f5b89291d50fed8
Instruction Fuzzy Hash: FDD1E575D10B5A8ACB10EFA4D950A99B7B1FF95300F20CB9AD0493B654EF70AEC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05050006 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1397396081.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5050000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c8b2e969da2e6fefcc3786f0c1a2dd92f9dc8179322dcdaab4e741c98c5a35
Instruction ID: ad99b40c01936dbf91a13e9b118457d01ea06bf819e6ba861abc1ed1a9b47b50
Opcode Fuzzy Hash: d5c8b2e969da2e6fefcc3786f0c1a2dd92f9dc8179322dcdaab4e741c98c5a35
Instruction Fuzzy Hash: 7DC106B1A017458FD3A8CF24E84829D3FB6BB81324B514329D1716B2D9DBB824CBCF48

Uniqueness

Uniqueness Score: -1.00%

Function 08721668 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1d765a34fea4dfc385e56ea0bd8af0e97d5fb1a08ed5d581be047a35a176cb
Instruction ID: 42628026457b15f1f32509963bef008fa4f875cdaaa172319d0dec63da78a033
Opcode Fuzzy Hash: aa1d765a34fea4dfc385e56ea0bd8af0e97d5fb1a08ed5d581be047a35a176cb
Instruction Fuzzy Hash: A6B1A674E01228CFDB68DF69C854B9DBBB2BF89300F5085AAD409AB355DB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08720D90 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ff694a123475336c38715fb3914e0c91a3f289a514f370a698ee88ce8363e3
Instruction ID: 23058ae36ac5b726cc402be77f3b21915c9794ca70e566034c638c49f7455c93
Opcode Fuzzy Hash: 33ff694a123475336c38715fb3914e0c91a3f289a514f370a698ee88ce8363e3
Instruction Fuzzy Hash: 9791C470E01228CFDB68DFA5C950B9EBBB2BF89300F5081EAD44AA7254DB345E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011925D8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390753874.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1190000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7109ea687d04cf18007084b6f36ab6a41a51b5357dc8f32e7a68e7eebd3ee4
Instruction ID: f5b2001351cc964ebe5bf423707473c5f52b680a6ea68e9aedb5df310489f363
Opcode Fuzzy Hash: 0e7109ea687d04cf18007084b6f36ab6a41a51b5357dc8f32e7a68e7eebd3ee4
Instruction Fuzzy Hash: 93315742C1E790AFDB5B3B3A48740C13FA1DD2352A70946D6C5B48E9E3F7A5044BD3AA

Uniqueness

Uniqueness Score: -1.00%

Function 08720011 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0d3d5694f9e43c1f983041b14bd57a58255bf24227ddb7a66a4a26622271e8
Instruction ID: 35074bba6e6b2afe5143cbb0fb073994535d39e9a979222c051e9487a2315a5f
Opcode Fuzzy Hash: 3f0d3d5694f9e43c1f983041b14bd57a58255bf24227ddb7a66a4a26622271e8
Instruction Fuzzy Hash: 33412B70D05668CFEB29CF66C8543DDBFB2AF89301F14C1AAC449A7265DB341A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08721659 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c1ebeacd3974cecb016c26c5f2eddb4d861268929783bd44a8f39ed624e7ba
Instruction ID: f5a949aefa2f2de56836d8edffdbbba0225b38a2a4313e681d2e3f979da95ccb
Opcode Fuzzy Hash: b9c1ebeacd3974cecb016c26c5f2eddb4d861268929783bd44a8f39ed624e7ba
Instruction Fuzzy Hash: C831D5B1E00629CBEB19CFA6C85079EFBB3BF89300F54C069C849AB259DB7119468F50

Uniqueness

Uniqueness Score: -1.00%

Function 08720CEC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1403874659.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8720000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe2fcfeddcf98d11b4693ee604de69a9bc39fab2f90c5d91393eb781a68297b
Instruction ID: cfafea5a12d396c63fdb05e575af1021fd28179b61f3be1d6c49d105187760fe
Opcode Fuzzy Hash: efe2fcfeddcf98d11b4693ee604de69a9bc39fab2f90c5d91393eb781a68297b
Instruction Fuzzy Hash: C5F0EDB0C49639CFDB249F54D8987FDBA70BB06306F10555AD41673198CB781684CFB4

Uniqueness

Uniqueness Score: -1.00%

Function 063AED10 Relevance: 5.2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

Strings

(_q, xrefs: 063AEDF9
(_q, xrefs: 063AEF79
(_q, xrefs: 063AEEFA
(_q, xrefs: 063AED7A

Memory Dump Source

Source File: 00000000.00000002.1398320141.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_3q1lESMAMh.jbxd

Similarity

API ID:
String ID: (_q$(_q$(_q$(_q
API String ID: 0-1088526261
Opcode ID: 2c16aacddebdbb2228a45956259c60d3446f674f3c709d464010a6658592532c
Instruction ID: f496abe807948882e3c070099d5541fcb3c9a4082c65ac37c6882a5c3fe62e8b
Opcode Fuzzy Hash: 2c16aacddebdbb2228a45956259c60d3446f674f3c709d464010a6658592532c
Instruction Fuzzy Hash: B391CA35A043049FDB08AF68D4246AE7BB2FFC9210F64856EE906DB381DA359D06CBD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3q1lESMAMh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3q1lESMAMh.exe.log

C:\Users\user\AppData\Local\Temp\Tmp6AD4.tmp

C:\Users\user\AppData\Local\Temp\Tmp6AE4.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
3q1lESMAMh.exe

Function 063A3F50 Relevance: 3.0, Strings: 2, Instructions: 522
COMMON

Function 08720040 Relevance: 2.0, Strings: 1, Instructions: 752
COMMON

Function 06390D80 Relevance: 20.6, Strings: 16, Instructions: 622
COMMON

Function 06391582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Function 063A48B8 Relevance: 1.8, Strings: 1, Instructions: 590
COMMON

Function 0119AE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 01195935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 05050BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 01194248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0119C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON