Edit tour

Windows Analysis Report
44QHzbqD3m.exe

Overview

General Information

Sample name:	44QHzbqD3m.exe renamed because original name is a hash value
Original sample name:	11ae7e8293ed1c199cde872ee52d910d.exe
Analysis ID:	1430977
MD5:	11ae7e8293ed1c199cde872ee52d910d
SHA1:	e8acbfe5d1015b5554237749e5d270bc2efbf0ab
SHA256:	0d28a4525dba00368e0a1a146b0c1e75656215338358a7dbd65ee5ca2508cacf
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

44QHzbqD3m.exe (PID: 6344 cmdline: "C:\Users\user\Desktop\44QHzbqD3m.exe" MD5: 11AE7E8293ED1C199CDE872EE52D910D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
44QHzbqD3m.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1635191784.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 44QHzbqD3m.exe PID: 6344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 44QHzbqD3m.exe PID: 6344	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.44QHzbqD3m.exe.df0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 103.113.70.99 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-12:37:07.455958
SID:	2046056
Source Port:	2630
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-12:37:01.914552
SID:	2046045
Source Port:	49730
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-12:37:15.327587
SID:	2043231
Source Port:	49730
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 103.113.70.99 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-12:37:02.151800
SID:	2043234
Source Port:	2630
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 44QHzbqD3m.exe

Malware Configuration Extractor: RedLine {"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Source: 44QHzbqD3m.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 44QHzbqD3m.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: c29d93bf0}.Tntkrnlmp.pdb source: 44QHzbqD3m.exe, 00000000.00000002.1814405574.0000000006E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbF@ source: 44QHzbqD3m.exe, 00000000.00000002.1814405574.0000000006E30000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 4x nop then jmp 07E1B488h	0_2_07E1AF90
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 4x nop then jmp 07E17242h	0_2_07E16F90
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 4x nop then jmp 07E183F7h	0_2_07E17C98
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 4x nop then jmp 07E17BF4h	0_2_07E17930

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 103.113.70.99:2630 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 103.113.70.99:2630 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 103.113.70.99:2630

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 103.113.70.99:2630

Source: Joe Sandbox View

IP Address: 103.113.70.99 103.113.70.99

Source: Joe Sandbox View

ASN Name: NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN

Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99

Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce4
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responseus
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.00000000032FD000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.00000000032FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4rA
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003387000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.00000000032FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: 44QHzbqD3m.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp7E60.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp7E50.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_055DDC74	0_2_055DDC74
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A367D8	0_2_06A367D8
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A3A3E8	0_2_06A3A3E8
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A3A3D8	0_2_06A3A3D8
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A36FE8	0_2_06A36FE8
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A36FF8	0_2_06A36FF8
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E1A2E0	0_2_07E1A2E0
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E1AF90	0_2_07E1AF90
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E16F90	0_2_07E16F90
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E18D38	0_2_07E18D38
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E1CC28	0_2_07E1CC28
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E168E8	0_2_07E168E8
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E1DD78	0_2_07E1DD78
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E17C98	0_2_07E17C98
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E1A2DD	0_2_07E1A2DD
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E14E48	0_2_07E14E48
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E14E37	0_2_07E14E37

Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 44QHzbqD3m.exe
Source: 44QHzbqD3m.exe, 00000000.00000002.1806623028.000000000156E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 44QHzbqD3m.exe
Source: 44QHzbqD3m.exe, 00000000.00000000.1635219062.0000000000E36000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUpspearing.exe8 vs 44QHzbqD3m.exe
Source: 44QHzbqD3m.exe	Binary or memory string: OriginalFilenameUpspearing.exe8 vs 44QHzbqD3m.exe

Source: 44QHzbqD3m.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp7E50.tmp

Jump to behavior

Source: 44QHzbqD3m.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 44QHzbqD3m.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003685000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003677000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000365F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 44QHzbqD3m.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 44QHzbqD3m.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 44QHzbqD3m.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c29d93bf0}.Tntkrnlmp.pdb source: 44QHzbqD3m.exe, 00000000.00000002.1814405574.0000000006E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbF@ source: 44QHzbqD3m.exe, 00000000.00000002.1814405574.0000000006E30000.00000004.00000020.00020000.00000000.sdmp

Source: 44QHzbqD3m.exe

Static PE information: 0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A240AD push ebx; retn FC07h	0_2_06A2430A
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A21DAE push FFFFFF8Bh; retf	0_2_06A21DB1
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A23BDC push E806F64Ah; retf	0_2_06A23BE1
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A3C711 push es; ret	0_2_06A3C720
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A3D412 push es; ret	0_2_06A3D420
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A3E060 push es; ret	0_2_06A3E070
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A3ECF2 push eax; ret	0_2_06A3ED01
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A33B4F push dword ptr [esp+ecx*2-75h]; ret	0_2_06A33B53
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_06A349AB push FFFFFF8Bh; retf	0_2_06A349AD
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Code function: 0_2_07E12060 pushfd ; iretd	0_2_07E120D5

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Memory allocated: 17B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Memory allocated: 17B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Window / User API: threadDelayed 977			Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Window / User API: threadDelayed 2723			Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe TID: 3624	Thread sleep time: -15679732462653109s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 44QHzbqD3m.exe, 00000000.00000002.1814405574.0000000006DED000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Code function: 0_2_07E18D38 LdrInitializeThunk,

0_2_07E18D38

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Users\user\Desktop\44QHzbqD3m.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\44QHzbqD3m.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 44QHzbqD3m.exe, 00000000.00000002.1819047477.0000000007C95000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 44QHzbqD3m.exe, type: SAMPLE
Source: Yara match	File source: 0.0.44QHzbqD3m.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1635191784.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 44QHzbqD3m.exe PID: 6344, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 44QHzbqD3m.exe, 00000000.00000002.1806697791.0000000001610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 44QHzbqD3m.exe, 00000000.00000002.1806697791.0000000001610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRdq
Source: 44QHzbqD3m.exe, 00000000.00000002.1806697791.0000000001610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets\*m
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $dq%appdata%`,dqdC:\Users\user\AppData\Roaming`,dqdC:\Users\user\AppData\Roaming\Binance
Source: 44QHzbqD3m.exe, 00000000.00000002.1806697791.0000000001610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets\*m
Source: 44QHzbqD3m.exe, 00000000.00000002.1814405574.0000000006DD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\*]?
Source: 44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $dq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\44QHzbqD3m.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 44QHzbqD3m.exe PID: 6344, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 44QHzbqD3m.exe, type: SAMPLE
Source: Yara match	File source: 0.0.44QHzbqD3m.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1635191784.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 44QHzbqD3m.exe PID: 6344, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15V	1%	Virustotal		Browse
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id19Responseus	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4rA	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15V	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003387000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce4	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003387000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	44QHzbqD3m.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Responseus	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4rA	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, 44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	44QHzbqD3m.exe, 00000000.00000002.1807370130.00000000032FD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	44QHzbqD3m.exe, 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.113.70.99	unknown	India		133973	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430977
Start date and time:	2024-04-24 12:36:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	44QHzbqD3m.exe renamed because original name is a hash value
Original Sample Name:	11ae7e8293ed1c199cde872ee52d910d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 83 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:37:12	API Interceptor	21x Sleep call for process: 44QHzbqD3m.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.113.70.99	3q1lESMAMh.exe	Get hash	malicious	RedLine	Browse
	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	3q1lESMAMh.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	https://www.wsj.pm/download.php	Get hash	malicious	NetSupport RAT	Browse	103.113.70.37
	3A8YbQ0RZ7.dll	Get hash	malicious	Qbot	Browse	103.113.68.33
	onuxDag8Co.exe	Get hash	malicious	LummaC Stealer, RedLine, SectopRAT	Browse	103.113.68.183
	wssays.exe	Get hash	malicious	Unknown	Browse	103.113.70.18
	sgiydd.exe	Get hash	malicious	Unknown	Browse	103.113.70.18

Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:29 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4564792794500083
Encrypted:	false
SSDEEP:	48:8ScdZTBnGRYrnvPdAKRkdAGdAKRFdAKR/U:8SaZ
MD5:	FCE7466A1C22ACAE692515C30151C8E8
SHA1:	9659EE5D69142F1B6C780D9BA44EC778DF320788
SHA-256:	648C9601A556E291DD3DE69FEA9821905C2C23FBC78D1E4FEA51F5C37135DA18
SHA-512:	6868001C445423E7B8B7B5924BF5F9591CCF14368BBD54CED429642017E239C617A398A14F9C01CD6AB503DD7824D29E543E55BD499CD186044602C60F576406
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....9zV........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWO`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWO`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWO`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\44QHzbqD3m.exe.log

Download File

Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp7E50.tmp

Download File

Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp7E60.tmp

Download File

Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.072480224114925
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	44QHzbqD3m.exe
File size:	312'093 bytes
MD5:	11ae7e8293ed1c199cde872ee52d910d
SHA1:	e8acbfe5d1015b5554237749e5d270bc2efbf0ab
SHA256:	0d28a4525dba00368e0a1a146b0c1e75656215338358a7dbd65ee5ca2508cacf
SHA512:	716565498fb3d68927b2145ca16bc7e4d44eb60ace7e590180832d512352198289de0942bbfc434438a19f2d1d22c2aeba5b0262ad7184f726bc8835d2e22982
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
TLSH:	B6645C1823EC8911E27F4B7994A1E274D375ED56A452E30F4ED06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F8CD91280B2h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F8CD91280B2h
jnc 00007F8CD91280B2h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F8CD91280B2h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F8CD91280B2h
je 00007F8CD91280B2h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F8CD91280B2h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F8CD91280B2h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b95c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b940	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e994	0x2ec00	64c48738b5efa1379746874c338807d5	False	0.4696168950534759	data	6.205450376900145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9d4	0x1cc00	5b3e8f48de8a05507379330b3cf331a7	False	0.23725373641304348	data	2.6063301335912525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	f921873e0b7f3fe3399366376917ef43	False	0.025390625	data	0.05390218305374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x35a	data	0.4417249417249417
RT_MANIFEST	0x4e7e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-12:37:07.455958	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2630	49730	103.113.70.99	192.168.2.4
04/24/24-12:37:01.914552	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	2630	192.168.2.4	103.113.70.99
04/24/24-12:37:15.327587	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	2630	192.168.2.4	103.113.70.99
04/24/24-12:37:02.151800	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2630	49730	103.113.70.99	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:37:01.398340940 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:01.631057024 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:01.631164074 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:01.650737047 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:01.871571064 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:01.913109064 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:01.914551973 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:02.151799917 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:02.194331884 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:07.214179039 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:07.455957890 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:07.456020117 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:07.456037998 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:07.456058979 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:07.456080914 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:07.456130981 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:07.456182003 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:07.577792883 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:07.815779924 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:07.818810940 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:08.039944887 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:08.050066948 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:08.271164894 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:08.319303989 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:08.336206913 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:08.572482109 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:08.572700977 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:08.637754917 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:08.856308937 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:08.924999952 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:08.967190027 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:09.188458920 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:09.197655916 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:09.429872036 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:09.438688040 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:09.443717957 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:09.664910078 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:09.671735048 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:09.909013033 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:09.915076017 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:10.166022062 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:10.167377949 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:10.445138931 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:10.491200924 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:10.552880049 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:10.774729013 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:10.774878025 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:10.775161982 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:10.775270939 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:10.775676966 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:10.775763988 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.000143051 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.000191927 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.000288963 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.000374079 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.000380039 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.000447035 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.000560045 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.000574112 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.000674009 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.220614910 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.220660925 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.223798037 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.223831892 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.223874092 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.223906994 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.223957062 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.223989010 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224020958 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224162102 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224265099 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.224277973 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224355936 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224389076 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224432945 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.224514008 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224592924 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224626064 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224678993 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.224963903 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.225070000 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.444639921 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.444704056 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.444835901 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.445070982 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.445126057 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.445400000 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.445507050 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.445666075 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.445784092 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446074009 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446109056 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446244001 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446405888 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446589947 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446746111 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.446986914 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.447226048 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.447321892 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.447393894 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.447559118 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.447664976 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.447932959 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.448201895 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.448429108 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.448606968 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.448941946 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.449124098 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.449651003 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.449687958 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.449723005 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.449754953 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.449997902 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450031042 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450104952 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450464964 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450498104 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450531006 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450647116 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450721979 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.450886965 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.451004982 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.451266050 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.451299906 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.451416969 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.451534986 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.451735973 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.452020884 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.495908022 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.496217012 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.496340036 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.669469118 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.669646978 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.669819117 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.681204081 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.681291103 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.681359053 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.681417942 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.681571960 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.681925058 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.682068110 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.720505953 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.720618963 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.720654011 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.720690966 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.720762014 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.720797062 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.721210003 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.721342087 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:11.915649891 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.937412024 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.937622070 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.959275007 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.959606886 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.980916023 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:11.992012978 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.002686024 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.002880096 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.024528027 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.024888039 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:12.025051117 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:12.046503067 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.062544107 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.062725067 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.062843084 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.063015938 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.063278913 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:12.263447046 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.285171032 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.286432028 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.286551952 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.286700010 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.286988974 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.287338972 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.287636042 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.287686110 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.289081097 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.300512075 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:12.521442890 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.524600983 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:12.780419111 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:12.835118055 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:13.343799114 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:13.573414087 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:13.835144997 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:13.881963968 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:13.909461021 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:14.138145924 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:14.142054081 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:14.371022940 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:14.413059950 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:14.423692942 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:14.649069071 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:14.709943056 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:14.780488968 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:15.006397009 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:15.063117027 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:15.326379061 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:15.327586889 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:15.577974081 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 12:37:15.631855011 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 12:37:17.083837986 CEST	49730	2630	192.168.2.4	103.113.70.99

Target ID:	0
Start time:	12:36:59
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\44QHzbqD3m.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\44QHzbqD3m.exe"
Imagebase:	0xdf0000
File size:	312'093 bytes
MD5 hash:	11AE7E8293ED1C199CDE872EE52D910D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1635191784.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1807370130.0000000003239000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1807370130.000000000339A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	15

Executed Functions

Function 07E1CC28 Relevance: 6.6, Strings: 5, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 07E1D081
Hhq, xrefs: 07E1D03A
Hhq, xrefs: 07E1CFD8
Hhq, xrefs: 07E1D0C8
Hhq, xrefs: 07E1D009

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: Hhq$Hhq$Hhq$Hhq$Hhq
API String ID: 0-1427472961
Opcode ID: 52fcc0e8888749f2bc2a86ea5a94ea3fd7a2d8fb6ab0454044c9c97777144ceb
Instruction ID: fafa711eabd8f2a61aedbf8bb46c92e8a0f5f184c790c73621d7ebeca1e4607d
Opcode Fuzzy Hash: 52fcc0e8888749f2bc2a86ea5a94ea3fd7a2d8fb6ab0454044c9c97777144ceb
Instruction Fuzzy Hash: 19F1C1B1E51256CBCB15CF74C5512BDFBF2BF85300F248669D406EB251EB389A85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07E18D38 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1088
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+,, xrefs: 07E19477, 07E1947C

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: +,
API String ID: 0-2694382870
Opcode ID: 65c4aaf721a826db4f5a2256ff3270c164bfc3eab8f10259f33849d6fc397980
Instruction ID: b55ccf8ab703d83f63b4b4f36b2d03ad814c513ecc67b741428c3b3ed582b95f
Opcode Fuzzy Hash: 65c4aaf721a826db4f5a2256ff3270c164bfc3eab8f10259f33849d6fc397980
Instruction Fuzzy Hash: E0C28DB4A022299FCB64DF25D998B9DBBB2FB89301F1085E9D40DA7254DB346EC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07E1AF90 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 07E1B295
., xrefs: 07E1B210

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 6ed8b3caebe632d7490e53201d620d150d956eac5dbcdc7d8830cfd864b37583
Instruction ID: 133a69451b1d4e9b2daeb43589470c9189542d27d7e3ca72137de5293fda1913
Opcode Fuzzy Hash: 6ed8b3caebe632d7490e53201d620d150d956eac5dbcdc7d8830cfd864b37583
Instruction Fuzzy Hash: 50F1CFB4E01229CFDB28DF65D995BDDBBB2FF8A301F1091AAD409A7250DB355A81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 07E16F90 Relevance: 2.7, Strings: 2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 07E17272
LRdq, xrefs: 07E1703A

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: LRdq$PHdq
API String ID: 0-3514635139
Opcode ID: 1f94db5bae3454d39e36a944d8b94758e65902ce323dc4764debd532305e2d5f
Instruction ID: d52a318a5dbc9c824a0e340b7f6aca3c6191335b86c40f9b8e9cca3700d83313
Opcode Fuzzy Hash: 1f94db5bae3454d39e36a944d8b94758e65902ce323dc4764debd532305e2d5f
Instruction Fuzzy Hash: 8EA1D3B4E01319CFDB24DFA5C955B9EBBB2BF89300F1091A9D409AB3A4DB305986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07E168E8 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 07E16A4A
$dq, xrefs: 07E16A3A

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: d98a0c2c2e6732811f79b63180b02cd63026af68bd4293833f7459d46aeec039
Instruction ID: 890f9c2231040c9fd92721042b77715cd445816cd2b417352a9215a3ae9db145
Opcode Fuzzy Hash: d98a0c2c2e6732811f79b63180b02cd63026af68bd4293833f7459d46aeec039
Instruction Fuzzy Hash: B791D2B4E01218DFDB14DFA9D584A9DBBF2FF89305F209469E419AB350DB359982CF10

Uniqueness

Uniqueness Score: -1.00%

Function 07E17930 Relevance: 2.7, Strings: 2, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#+, xrefs: 07E179FE, 07E17A03
[+, xrefs: 07E17B1D, 07E17B22

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: #+$[+
API String ID: 0-3892461662
Opcode ID: 283c15b016553eebfdfe31fe55482fcd14422f5f20a7be8a9f3529ff6352c57d
Instruction ID: 802e998fb2bff7b647038aa4a1016dfa653e72be0fd3876096e1105eb892b8ae
Opcode Fuzzy Hash: 283c15b016553eebfdfe31fe55482fcd14422f5f20a7be8a9f3529ff6352c57d
Instruction Fuzzy Hash: 0891F4B0D01229CFDB64DFA9C985BDDBBB2BF99300F1095A9D409AB254DB346E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07E1DD78 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24c01a72b90c459d2cebe30ec8daaaef036cdaf7ac475670e6a932157b35aa0
Instruction ID: 37d71f799f96d8c1d0be04fe631bd6926b375dc055f2419d07aeb3bf87fa1fd8
Opcode Fuzzy Hash: f24c01a72b90c459d2cebe30ec8daaaef036cdaf7ac475670e6a932157b35aa0
Instruction Fuzzy Hash: 5C8256F4600216CFDB24CF38D949B6977B5BF48209F1481E8E9099B7A5EB349C85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07E17C98 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1396bc37009ffb538982534682f204f0ba8c3f604e5772452a2a2a85c9894868
Instruction ID: c01a1b9e28b93c8111b10c4a58bd2c544d8408f81388ae2337e8197064bfeac7
Opcode Fuzzy Hash: 1396bc37009ffb538982534682f204f0ba8c3f604e5772452a2a2a85c9894868
Instruction Fuzzy Hash: 06227DB4D012298FDB65DF69C991BD9B7B2BF89304F1091EAD449AB250EB305EC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A367D8 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047ab65fda7a3e4411f22dbb6fc32d886d03969b4934073dc9b722e9f64b6e4e
Instruction ID: 199218dbc5bdd4064be588a31290e97ef1661d1ee18f2596829757c0441a2a6d
Opcode Fuzzy Hash: 047ab65fda7a3e4411f22dbb6fc32d886d03969b4934073dc9b722e9f64b6e4e
Instruction Fuzzy Hash: EAF16D70A01325AFCB55DFA8D844A9EBBF2EF89300F158569F5099F2A1DB30E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A3A3D8 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82cb3c266c95e38d923f6124f1df8762215581939cbe29526c57c184fb434c3d
Instruction ID: 5a9e88e951465571aef69ed5215d6732bfd2fab9f42c25f9f8c6ef210f69686d
Opcode Fuzzy Hash: 82cb3c266c95e38d923f6124f1df8762215581939cbe29526c57c184fb434c3d
Instruction Fuzzy Hash: E5D1F770D01318CFCB54EFB5D854A9DBBB2FF8A301F1085A9D90AAB294DB356986CF11

Uniqueness

Uniqueness Score: -1.00%

Function 06A3A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35764568b7db7fcde792b6414175df43359d30eee2f6cbf2adcf2a4b03ce4ce7
Instruction ID: dc38d249e98838d45ea5560b71d20f2b25add11c791067a5be7a283db81cc715
Opcode Fuzzy Hash: 35764568b7db7fcde792b6414175df43359d30eee2f6cbf2adcf2a4b03ce4ce7
Instruction Fuzzy Hash: B0D10730D01318CFCB54EFB5D854A9DBBB2FF8A301F2085A9D90AAB294DB356885CF11

Uniqueness

Uniqueness Score: -1.00%

Function 07E1A2E0 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bc593095f787666f14163e7e8f9cbf5f14356cead5ce560b39c1ae975c4338
Instruction ID: d1e5c0f9e1beeeb3fef8e1e2ea071736b351c903ed38bf345b6b4be8f413130f
Opcode Fuzzy Hash: 59bc593095f787666f14163e7e8f9cbf5f14356cead5ce560b39c1ae975c4338
Instruction Fuzzy Hash: D1C1B6B0D012298BDB64DF69C951BEEBBB2BF89300F10D1E9C409BB294DB755A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A20D80 Relevance: 20.6, Strings: 16, Instructions: 619
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A21455
$dq, xrefs: 06A213AC
$dq, xrefs: 06A21336
$dq, xrefs: 06A21430
$dq, xrefs: 06A21461
$dq, xrefs: 06A2137B
$dq, xrefs: 06A20E52
$dq, xrefs: 06A213A0
$dq, xrefs: 06A213EB
$dq, xrefs: 06A20F86
$dq, xrefs: 06A20E02
$dq, xrefs: 06A20FB8
$dq, xrefs: 06A20FAC
$dq, xrefs: 06A20E84
$dq, xrefs: 06A20F36
$dq, xrefs: 06A20E78

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-256639137
Opcode ID: 2289146663c87799ffc310f91b27577d49061f80ac04f15a42d4bd258c477212
Instruction ID: ea284f44ce062fee66d317c2c013cb7c63592a1d73569bd2e0f78af5b957e684
Opcode Fuzzy Hash: 2289146663c87799ffc310f91b27577d49061f80ac04f15a42d4bd258c477212
Instruction Fuzzy Hash: F0329170B402169FDB54DB69D944A6ABBF7FF89300B258469E906CB3A2CF34DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A21577 Relevance: 7.8, Strings: 6, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A21A12
$dq, xrefs: 06A21A7C
$dq, xrefs: 06A21A88
$dq, xrefs: 06A21A57
$dq, xrefs: 06A218E3
$dq, xrefs: 06A2182E

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: b80fe672b15fd51a0406bcc4d83b8078e7dbf4e42556be08d6d709b84e0fe7bb
Instruction ID: 51df8d81338c42ca33adc739cb34bff853e1b454427cf1f5d9b36dc78b774076
Opcode Fuzzy Hash: b80fe672b15fd51a0406bcc4d83b8078e7dbf4e42556be08d6d709b84e0fe7bb
Instruction Fuzzy Hash: 34C1D5707402529FDB549BA8C454A3F7BF6FF89304B244469EA068B392DF75DC06C791

Uniqueness

Uniqueness Score: -1.00%

Function 055DAE30 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 49434c15ac6ef720d41d1d9b466c578ff4054cd82a0666034c1e4eefc649f89d
Instruction ID: d3c509aced9257daaf2c7d84676f0e117f8df7c28d2822f62774cebca8aba043
Opcode Fuzzy Hash: 49434c15ac6ef720d41d1d9b466c578ff4054cd82a0666034c1e4eefc649f89d
Instruction Fuzzy Hash: F67103B5A00B068FD724DF69D14575BFBF2FB88200F00892DD48AD7A50DB75E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A33F50 Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A341E4

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: c6301130a2217d4cdf18eae128fb30b8b64e0933a1c4370d7e9852fb3ff5d0e4
Instruction ID: ec656ce2bc68fd60acd8c7a3522c8cc68aea80acb55fd5cdb7ef8a44c6eecd4e
Opcode Fuzzy Hash: c6301130a2217d4cdf18eae128fb30b8b64e0933a1c4370d7e9852fb3ff5d0e4
Instruction Fuzzy Hash: 92E12C74F006158FCB54EF69C5949AEBBF6FF88600B158169E906EB365DB31DC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 055D4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 055D59F1

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9e11c2de8d253cab268c489bad3c9b5dcaa4b01cf17f087ebc74c78fe20cf536
Instruction ID: 0fa7e26c5e7b096d74619f57eece9830d38cdea0074ab69f52d495b571fea7da
Opcode Fuzzy Hash: 9e11c2de8d253cab268c489bad3c9b5dcaa4b01cf17f087ebc74c78fe20cf536
Instruction Fuzzy Hash: 8841DFB1C0072DCADB24DFA9C884B9DBBF5FF49314F20806AD409AB251DB756945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 055D5935 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 055D59F1

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9a244bd4681ba5175653bc367837f7f03244ebaa8fd003e23f18cbd57ef27d84
Instruction ID: 0054bb73cdce80869d3a005ae370aec27f5aaa1b3939ce77b35add2f21340c70
Opcode Fuzzy Hash: 9a244bd4681ba5175653bc367837f7f03244ebaa8fd003e23f18cbd57ef27d84
Instruction Fuzzy Hash: 6A41D1B1D00729CADB24DFA9C884BDDBBF5FF48305F20806AD409AB255DB756949CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A359C8 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

d, xrefs: 06A35C29

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 16da73ac322af075f3ac534862de10001a366040185e06557324853c50fa8759
Instruction ID: 6e05db16ec262832bb22e5dd941f487ce4e5f1a67d8b3429b069816ccffca84e
Opcode Fuzzy Hash: 16da73ac322af075f3ac534862de10001a366040185e06557324853c50fa8759
Instruction Fuzzy Hash: CCD15834A00612CFCB64DF5DC58096ABBF2FF88314729CA59E45A9B665D730FC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055DC9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,055DD2C6,?,?,?,?,?), ref: 055DD387

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7d14463740e25de8303826f98d570ff420996ffb1b0e8f0d6d879ed4d22294a3
Instruction ID: e295180302a6c8f558809b610a1f1a93d6999468d8161db1da621385c4bdd7de
Opcode Fuzzy Hash: 7d14463740e25de8303826f98d570ff420996ffb1b0e8f0d6d879ed4d22294a3
Instruction Fuzzy Hash: CC21D2B59003489FDB10CF9AD984AEEFBF5FB48320F14841AE959A3350D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055DD2F9 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,055DD2C6,?,?,?,?,?), ref: 055DD387

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b8055d2ff0fe5b71d7f233e5085513a9b5755ca111a71654d58142c170bf8515
Instruction ID: e762cf39e0d7851839ae3c0ac69d00a8eab44646c540747013169e106331731f
Opcode Fuzzy Hash: b8055d2ff0fe5b71d7f233e5085513a9b5755ca111a71654d58142c170bf8515
Instruction Fuzzy Hash: A4211FB58003499FDB10CFA9E585ADEFBF4FB48320F24841AE918A7250C338AA50CF61

Uniqueness

Uniqueness Score: -1.00%

Function 055DA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055DB101,00000800,00000000,00000000), ref: 055DB312

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7a0e4a8491400ea65cb4e05da6967eb056001fd008a13abbaf15e6658bf2b2d6
Instruction ID: 832893b546965a114bf85423c082680a4e1377c5b0bba80aa97e337a6319db75
Opcode Fuzzy Hash: 7a0e4a8491400ea65cb4e05da6967eb056001fd008a13abbaf15e6658bf2b2d6
Instruction Fuzzy Hash: DE1114B68003498FCB20DF9AC444A9EFBF5FB48320F11842ED919A7200C775A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055DB2A0 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055DB101,00000800,00000000,00000000), ref: 055DB312

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c9b760718379fd0d1d7b073d78dd4c724c9a8f67b22d527d2e0c15b88ff630bf
Instruction ID: bc2e8538523e089404948a0e3f98897d2d7109d64237b6118c9f27066f4109ff
Opcode Fuzzy Hash: c9b760718379fd0d1d7b073d78dd4c724c9a8f67b22d527d2e0c15b88ff630bf
Instruction Fuzzy Hash: E41126BA8003098FDB10CF9AC445ADEFBF5FB48310F10842ED429A7210C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055D9838 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,055DAE4C), ref: 055DB086

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e83cb87479a9a9a7ff55f5fe0fd7a80f47a4cf3b54df9565d824a6820d8c8923
Instruction ID: 18d0487c28a7f480c079b591b5ea7f3be3e472a6249cf526253f574af0374b54
Opcode Fuzzy Hash: e83cb87479a9a9a7ff55f5fe0fd7a80f47a4cf3b54df9565d824a6820d8c8923
Instruction Fuzzy Hash: F511F0B6C007498FCB20DF9AC444B9EFBF5FB89220F11845AD429B7210D375A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A33DE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A33F25

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: a3ae4982aeb2d4c0c8cd94eed91c2e25976a68797f4b2fd0535ed1fc0537d861
Instruction ID: ea76f2a993965f796e26e934ac8d7b065924e9eb73dea0975d079b7a8be650e1
Opcode Fuzzy Hash: a3ae4982aeb2d4c0c8cd94eed91c2e25976a68797f4b2fd0535ed1fc0537d861
Instruction Fuzzy Hash: 6531F431B093A14FC756AB78A85046E7BE6EFC621131544AEE04ACF791CE35EC07C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A384C8 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A385B1

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 179d21cbcf698e0122860a0db8586c0cdac3c6b8dca1e8efec50d26814eef124
Instruction ID: 084000d936eb4c75ca903f79bb9e5c79032cc371a008ac3fc2327e09545452ac
Opcode Fuzzy Hash: 179d21cbcf698e0122860a0db8586c0cdac3c6b8dca1e8efec50d26814eef124
Instruction Fuzzy Hash: 25316B71B002169FCB09EB7DA5545AF3BE7AFC8201B144439E50ACB385EE39AC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 06A3B358 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A3B399

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 4228fbd4c7a590cd6299e31ce74ed15eff369dd0d37a1eae665e5240236b5b47
Instruction ID: d10ba4dc170f147ff61695050a239d20fbd130f325caeeec4b1c43410776e790
Opcode Fuzzy Hash: 4228fbd4c7a590cd6299e31ce74ed15eff369dd0d37a1eae665e5240236b5b47
Instruction Fuzzy Hash: 8401BC3490634AAFCB01EFB8E96469D7FF2FF85200B1445A9E90597250DA302E85CB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A33EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A33F25

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: c1fb174a29efa24dad92200fca66b477d3b78faf3a2b39a9fc5086103cf4aac8
Instruction ID: 23f4d433357776c182df7ad733d89b34367b7c3e1cdc7318afc0b7ea1f532bbb
Opcode Fuzzy Hash: c1fb174a29efa24dad92200fca66b477d3b78faf3a2b39a9fc5086103cf4aac8
Instruction Fuzzy Hash: 13F090313103124FC649FB69E45096E77D7EBD9212350892DE40E8BB54EE30BD4687E5

Uniqueness

Uniqueness Score: -1.00%

Function 06A3B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A3B399

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: e4e92438c8d4bec5833d47f8558fc5487f60e6d9d9aa118e227023266b5bca0a
Instruction ID: 18c795a796e8d158ad93bc09e305b7fd08f40e259fbd2b38e9f0e48e5506cc9b
Opcode Fuzzy Hash: e4e92438c8d4bec5833d47f8558fc5487f60e6d9d9aa118e227023266b5bca0a
Instruction Fuzzy Hash: 13F03C74A0230AEFCB44EFB8E55465C7BF2FB95201F1485A9D90997254EF302E85CB45

Uniqueness

Uniqueness Score: -1.00%

Function 06A22078 Relevance: 1.0, Instructions: 1038COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccb916b025fdf55fc9283e28673368e95661b7598161243fc6b08b49c534a39
Instruction ID: ee4fc729e62513490fa93eb94ecf5ea81a87a4419ecb5fc2c5b199d585650f0f
Opcode Fuzzy Hash: cccb916b025fdf55fc9283e28673368e95661b7598161243fc6b08b49c534a39
Instruction Fuzzy Hash: 08925170A402189FCF559F64C951BEDBBB6FF88700F11809AE509AB3A1DB319E81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A200D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9975e7e5a4bfc620bdd9ac9c56e8408ed4281c17aec780bf5efcc1dfb5145ad5
Instruction ID: fdc9a72dc43f1ed57c9d18dcce71feccb4bc24d8bcead2d527b6dd0b9635fd13
Opcode Fuzzy Hash: 9975e7e5a4bfc620bdd9ac9c56e8408ed4281c17aec780bf5efcc1dfb5145ad5
Instruction Fuzzy Hash: 8642853074062A8FDB64AFB8946462EBBF2FFC5701B50499CD5079B3A1CF79AC458B81

Uniqueness

Uniqueness Score: -1.00%

Function 06A21FA0 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14c7300c6b21d1edfebed6088ca6269a4a8fd3d3407dca7c529e05c2658c6bc
Instruction ID: 5a673148a5c41cae21b22101acce5517d2021b8a9578f7223e38d3c885d61fd2
Opcode Fuzzy Hash: f14c7300c6b21d1edfebed6088ca6269a4a8fd3d3407dca7c529e05c2658c6bc
Instruction Fuzzy Hash: 2C428270B401149FCB589B24C995AAE77B6FFC8704F118099EA069F3A2CF71ED81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A200B7 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e2e148ccc9e410dfbf4636c94bb53f827b785e40ebd97c90ad19f0e58cc09c
Instruction ID: cb820b891808457c765c64e8166c3c6e342693c79c7cd2138ebf4ee06b50d4a8
Opcode Fuzzy Hash: f3e2e148ccc9e410dfbf4636c94bb53f827b785e40ebd97c90ad19f0e58cc09c
Instruction Fuzzy Hash: E0C19F30B402159FDB449FA9C859B7A7BFAFF89700F108059EA069B3A1CB75DC85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A34AFF Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d576ac1108d0ee8ceaccc25e4bacfa1e5fd80d0d760e5a44dfdf093f57029ca7
Instruction ID: 7f2118f3816c4dc3d7b4318abcf7b5cf4674336fbca2472a4275470e38e2b6b9
Opcode Fuzzy Hash: d576ac1108d0ee8ceaccc25e4bacfa1e5fd80d0d760e5a44dfdf093f57029ca7
Instruction Fuzzy Hash: FFC16A74B006158FCB45DF79C484AAABBF2FF89301B2585A9E546CB762DB30EC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06A240AD Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de9cbdc8b379cc524f05e1919d584737d665261335c78710fdb539d6182204d
Instruction ID: 2f015ddfc3952552306f2e1c64e75852d824bf7381600b38a883400306a5971e
Opcode Fuzzy Hash: 8de9cbdc8b379cc524f05e1919d584737d665261335c78710fdb539d6182204d
Instruction Fuzzy Hash: 4C813870B002149FCB44DBA8C894EADBBF6EF89700F11809AE605DB3A2CB71ED45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A37D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f988dd8d106e0ada86572090bc9fd32bb95014e7f103868deee06c8fa20eb41d
Instruction ID: 7d9c0b6b9b5ca98d155e1fc420ecff1480b4530f3585d08e84b0160724e4e54b
Opcode Fuzzy Hash: f988dd8d106e0ada86572090bc9fd32bb95014e7f103868deee06c8fa20eb41d
Instruction Fuzzy Hash: 435126B1E003288FDB64DFA9C884BEEFBB5BF48300F248529E415AB244DB749841CF84

Uniqueness

Uniqueness Score: -1.00%

Function 06A37D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db2ca2a8b9c26f31f2c3310b300db612ce32a48564e2e11281a4d53fcdaa704
Instruction ID: 35502f03687ba1a76adde441ad9ed94a29bfd3ce33cb1afc2879feb9805e99b5
Opcode Fuzzy Hash: 8db2ca2a8b9c26f31f2c3310b300db612ce32a48564e2e11281a4d53fcdaa704
Instruction Fuzzy Hash: 615134B0D003699FDB65DFAAC885BDEFBF5BB48300F248529E405AB280DB749841CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A35579 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6447ac96dfc284facb4b26608a9fb1277bf4637700979917043ef2f5bbbe049a
Instruction ID: a20e92b7c6f181530547deed4436479d91fc0e0b96ae5cc81ce7418d8aec4464
Opcode Fuzzy Hash: 6447ac96dfc284facb4b26608a9fb1277bf4637700979917043ef2f5bbbe049a
Instruction Fuzzy Hash: 7C415774B012209FCB16DF39D88495E7BB6EF89241B4584A9F905CB355CB30DD06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A35588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3afbc77fafb48c6d6a93b5abddf49157b5fc01dc73efe2bb718b8870a2a864
Instruction ID: 1e8d3f18d5208dc053caee54e3634243356c8b3ea48b178f5d0584ac522f26e8
Opcode Fuzzy Hash: 6e3afbc77fafb48c6d6a93b5abddf49157b5fc01dc73efe2bb718b8870a2a864
Instruction Fuzzy Hash: 6F315774B012209FCB45DF38D88496EBBB6FF89201B458469F906CB355DB31ED02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A387A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f47716bdcfdb558b7ddb713082eb267fc5005205d25282d84facd2d424eb75
Instruction ID: f5c07f99bc51fdc5faafd24e89f23cc8220ec6384eeecfaa268c2ef41b4b74ad
Opcode Fuzzy Hash: 80f47716bdcfdb558b7ddb713082eb267fc5005205d25282d84facd2d424eb75
Instruction Fuzzy Hash: 7E4122B1D01218DFDB18DFAAD944ADEFBF6AF88300F10802AE415BB250DB34A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A38796 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e985d415d8e97cc50007abd98845dea386ca8b12ab161e5da65a4fccd537886
Instruction ID: 1b15d75329d690f460f1661a3dad6916207f9018b078763858a1715e84bb5c7b
Opcode Fuzzy Hash: 8e985d415d8e97cc50007abd98845dea386ca8b12ab161e5da65a4fccd537886
Instruction Fuzzy Hash: 873124B1D012589FDB14DFAAC944ADEFFF6AF88300F14802AE415BB290DB759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A230FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d846c350eddcbbdac7961ead9cd99b3bc79a2e9cd2c46fb45ab30a4118bc5737
Instruction ID: ab1ea8505c6aa572b5a72760210a52c3168f16c3e9ef89b1a52d8567bad48ba3
Opcode Fuzzy Hash: d846c350eddcbbdac7961ead9cd99b3bc79a2e9cd2c46fb45ab30a4118bc5737
Instruction Fuzzy Hash: 2F215C35B40014AFCB54DF69D984EA9BBB2EF88714F1280A9F9059F3A2CB31EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A2360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3ec36cd12c0dd934a401f7ea1c68079c95ebdd315ee19306778b6ce83edcf3
Instruction ID: a01fc054281866e1d4e5411234197c6efed50da0ba69d4099eb8d17385531719
Opcode Fuzzy Hash: 1d3ec36cd12c0dd934a401f7ea1c68079c95ebdd315ee19306778b6ce83edcf3
Instruction Fuzzy Hash: 5B217F35B400159FCB54EF29C884DAABBB2FF89714F1180A5F9099F3A2DA31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A2345B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f555180d2ec75bcb1a174387f90644996abf936c09aad3fe941fca64abeb84c9
Instruction ID: 3db751350ffb0495327c57b17f7b7abd5ee09c47d558a58229b76c41c81b3370
Opcode Fuzzy Hash: f555180d2ec75bcb1a174387f90644996abf936c09aad3fe941fca64abeb84c9
Instruction Fuzzy Hash: 1F216D36B40014AFCB54DF29C994DA9BBB2EF88714F1180A9F9059F362CB31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A38A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5922fea4abe5356adad1a8295d999e645e51a1f5b6908f15b44f15ac8998c56
Instruction ID: c875e29568a9afd903e54a31680f259f2afe4f546fbdaeb23d5c25e835e4997c
Opcode Fuzzy Hash: d5922fea4abe5356adad1a8295d999e645e51a1f5b6908f15b44f15ac8998c56
Instruction Fuzzy Hash: 193112B1D01259DFDB54DFA9D894ADEFBF5BF88310F24802AE409BB241C778A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0150D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806293579.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4a59038286649a701c9e0b5a2c77001e15208f0a9c74bfeec59a225d1eb0dc
Instruction ID: 6206787da5501978ad890cfb66efd3cabf6601c8191e048fe19c7d1c5297be92
Opcode Fuzzy Hash: 0e4a59038286649a701c9e0b5a2c77001e15208f0a9c74bfeec59a225d1eb0dc
Instruction Fuzzy Hash: F52124B1500200DFDB02DFC8C9C0B6ABFB5FB94324F20C569E90A0F286C376E416C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 06A21068 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814038588.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251fb3e8b860cb5ecb89d1b45bd27fa428ac598b6770cde19f91c3f02da7c747
Instruction ID: b0fb32edc84525e501d2a81b2aea30f59bff59ec8b60eecdf3b21c8deb4aaf1c
Opcode Fuzzy Hash: 251fb3e8b860cb5ecb89d1b45bd27fa428ac598b6770cde19f91c3f02da7c747
Instruction Fuzzy Hash: EC21C230B00115AFDB449BAEE9449AEB7FAFFD82107258169E9198B3A5DB30CC51C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0151D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806333089.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_151d000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cc7a860761af7f635b9da15ce13fa67516f39a95eb075063094bb04e0d31f1
Instruction ID: 113223dcc56a6207629ff73564801dd59421bffdcce2388691c1f334aafd216e
Opcode Fuzzy Hash: e0cc7a860761af7f635b9da15ce13fa67516f39a95eb075063094bb04e0d31f1
Instruction Fuzzy Hash: FC210375604200DFEB16DF58D8C8B26BBB5FB84314F20C96DD80A0F24AD33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06A38F42 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76ebe6d4b6a72ea2ec9af77601a8b5608abeb27164500ec458763be447dbbca
Instruction ID: bb2f767394a8c62aa592add18da3e67807a492504cb14835e184e614b353ace7
Opcode Fuzzy Hash: c76ebe6d4b6a72ea2ec9af77601a8b5608abeb27164500ec458763be447dbbca
Instruction Fuzzy Hash: D021E2B4D0526ADFCB00DFA8D584AEEBBB1EF49301F1040AAF415AB351D7385A81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A38A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018459236969ac6a52905ecc17ee4fd892df38e6732d0c1778bf1403343bb9e1
Instruction ID: 2c823023b6b8dbe0776bb04510f1c624b215a2977db35c74c5a52af2c65e754a
Opcode Fuzzy Hash: 018459236969ac6a52905ecc17ee4fd892df38e6732d0c1778bf1403343bb9e1
Instruction Fuzzy Hash: DE2117B0D013599FDB24DFA9C895BDEBFF9AF48310F14842AE405AB241C7749845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A36E72 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a03fdb0a2fbf33585b3321079b9966ecaeac57376a80d0b1c7cf9dc62b3c10
Instruction ID: c873e983e26d036fb25a2b632ea68c1e22a57d32e3edb8a3b4738550db1801f6
Opcode Fuzzy Hash: 33a03fdb0a2fbf33585b3321079b9966ecaeac57376a80d0b1c7cf9dc62b3c10
Instruction Fuzzy Hash: D711C43220D3E52EC7525BA95C50CFB7FADDA8B161309419BFAD5C7083C0188A26D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0151D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806333089.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_151d000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914b5a07b1f3fd382cb64947eefe2f7db7a0e2eda4e6a62bfb4f4efbd80e5f86
Instruction ID: 2389e5a699fe433cc7e0dad251f1709d3d48551de53fd4de92f02a459149932a
Opcode Fuzzy Hash: 914b5a07b1f3fd382cb64947eefe2f7db7a0e2eda4e6a62bfb4f4efbd80e5f86
Instruction Fuzzy Hash: BB219F755093808FDB03CF24D994B15BF71FB46214F28C5EAD8498F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0150D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806293579.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: fbab301ff132113a8b63f4de89bcbd2563c5167df9f3deb458629286dd66cb5c
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: FA11DF76504240CFDB02CF84D5C4B5ABF72FB84324F24C2A9D9090F296C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A38350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385dd01de9a059cb6b46cf74a966b135efcb7d008f93422f0936892178dd04c2
Instruction ID: 253be5ed7ed87ed93052fba99dd15664c27051fae19612cee82ecb3ded3fa44e
Opcode Fuzzy Hash: 385dd01de9a059cb6b46cf74a966b135efcb7d008f93422f0936892178dd04c2
Instruction Fuzzy Hash: 69017172B0011A9FDF10DEA9AC44ABFF7FAEBD8651B144036E605D3240EB30991587A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A3C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc29700dd80dbfc7c330f69f8ed092f91ef64c4034ca983b9eebf8eea085531
Instruction ID: a732a3f9d31fe5c5499bb724bcb5bfe2424163f75aec838df5e78a91e0ed50ef
Opcode Fuzzy Hash: ccc29700dd80dbfc7c330f69f8ed092f91ef64c4034ca983b9eebf8eea085531
Instruction Fuzzy Hash: 1A01A1342043058FD316DF74E41866A3BE3FFC5312B108A2AD14A8B684CF74AD4A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 06A3BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34178f86b8cf99b88cf87649bc595eec833b0b34b013b84f7aea69beafcde5f6
Instruction ID: cb86dcc0534d52a6cf401da626873c450697f24abf01e1cc1994a68ec41aa2d2
Opcode Fuzzy Hash: 34178f86b8cf99b88cf87649bc595eec833b0b34b013b84f7aea69beafcde5f6
Instruction Fuzzy Hash: 94019A3121030B5FC686A778A46452E3AE3FFE13527458828EA0B8B690DE307D868792

Uniqueness

Uniqueness Score: -1.00%

Function 0150DAC5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806293579.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62d97b2c5bfe43db38cf09958c7349fa7b0c840f014c28525de0c1da417f660
Instruction ID: 0f4b1034e8c5d9fff0f944feed47660400fce656d002d3efb684efb79b088a7f
Opcode Fuzzy Hash: c62d97b2c5bfe43db38cf09958c7349fa7b0c840f014c28525de0c1da417f660
Instruction Fuzzy Hash: F301F2310087409AE7228ED9CCC4B6BBFF8FF51325F18C85AED090E2C2C6789840CA71

Uniqueness

Uniqueness Score: -1.00%

Function 06A3C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3acdfeba4675de4b32e75f8224af891a2aa89ede961ff4cf0e7da427ba78cfca
Instruction ID: e8bf4a4b34812846c773c5467ca299108c7490856aaa4d7c255eca75aa6b7f9e
Opcode Fuzzy Hash: 3acdfeba4675de4b32e75f8224af891a2aa89ede961ff4cf0e7da427ba78cfca
Instruction Fuzzy Hash: 9F019E342003098FD365EF65D01865A7BE3FBC8312F108A2DD14B8B684CF74AC4A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 06A35508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d4cdebb24d27e33ce17ae46d85ff6ee1f8e24c5da1966efdd87e0c191a69be
Instruction ID: 0221e1f3b163192067fccfbbc7d5f18ddf47b1a26c827e9ce8f3ff1c6c4e3291
Opcode Fuzzy Hash: 96d4cdebb24d27e33ce17ae46d85ff6ee1f8e24c5da1966efdd87e0c191a69be
Instruction Fuzzy Hash: D5016D30E05722CFDBA9AB6DE544627B7F7BF84205714882CF4078AA14DB75F480CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A367C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff2dc1832890d6176b0d6464cb42424aa4c3d1c3bcdc95a8f15fbe5fccde3a5
Instruction ID: e488ccc249e7c1b73ecc206027841b5c73303634d5b10d20e61553ee79fbc7bc
Opcode Fuzzy Hash: 3ff2dc1832890d6176b0d6464cb42424aa4c3d1c3bcdc95a8f15fbe5fccde3a5
Instruction Fuzzy Hash: C8F0CD31B443207FC7219A69AC45F967FEAEB86720F048126F214CF1E2D6B1E8469390

Uniqueness

Uniqueness Score: -1.00%

Function 06A38F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b6329f6777f713e7d33b8d0ea7ef78eaa9a333251f1449c20d28fc486e56d8
Instruction ID: 52d1ba5555fa7ff93d247878826c43669747d7cc1517ed37dac93fca0329f2d9
Opcode Fuzzy Hash: 20b6329f6777f713e7d33b8d0ea7ef78eaa9a333251f1449c20d28fc486e56d8
Instruction Fuzzy Hash: 8401D2B4D0421AEFCB44EFA9D9456AEFBF5BF48301F1090AAE815A3340E7780A40DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0150DAC4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806293579.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95443fbd585aa4468a24d232cd09712b4e648c6ad667d985efab91f1fdf8f13d
Instruction ID: cf557eacc2165b6b091bdbf40e8f44ad94381f27af59ecd4d8c6fd07565bb6f9
Opcode Fuzzy Hash: 95443fbd585aa4468a24d232cd09712b4e648c6ad667d985efab91f1fdf8f13d
Instruction Fuzzy Hash: C0F0C232004740AEE7218E89CC84B66FFE8EB40334F18C15AED080F2C6C6789840CE70

Uniqueness

Uniqueness Score: -1.00%

Function 06A36EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9903350e166943860c9f686600abee12217df2f6fe96a7ac794a93da0d249321
Instruction ID: e8c095cdcf3a333dbef1433273def7df244ba27d4231e9fb14c234a24334b90e
Opcode Fuzzy Hash: 9903350e166943860c9f686600abee12217df2f6fe96a7ac794a93da0d249321
Instruction Fuzzy Hash: 40F012622041E93F8B558F9A5C10CFB7FEDDA8E1617084156FE99D2191C429C921ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 06A3C110 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68e5b36049fa20dcef02393b96e5773129c0b9f82685f7c925eb7c0d6163d80
Instruction ID: a6e36d15d359faa5376304aa9cafa18120a80b4f1b612d434667b44bfa5ec24c
Opcode Fuzzy Hash: f68e5b36049fa20dcef02393b96e5773129c0b9f82685f7c925eb7c0d6163d80
Instruction Fuzzy Hash: 52F0BB3010A7E05FC312D739E81879B7FF6DF82255F08455AF246CB252CA656D0587A2

Uniqueness

Uniqueness Score: -1.00%

Function 06A38FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c59729e90607b2445a750cbe1b49e2f07e1f0282c867ea97123e202f41646b
Instruction ID: e93bcc05aed2e674b7bcfa40d06febaa0e6dc118cd7974562e70bac006610422
Opcode Fuzzy Hash: 38c59729e90607b2445a750cbe1b49e2f07e1f0282c867ea97123e202f41646b
Instruction Fuzzy Hash: F0F0A9B0C082699FDB00DFA4C8060AEBFB0EF5A201F04418AF406EB351E6394A01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A38341 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f132019696fbe9de6bc5936d18a3140bde0c7e92c6013e6de70ad36a9e331de
Instruction ID: 3f40d771494a19d9363d09e760de1621015ff211fac97ba46938c57e413d1511
Opcode Fuzzy Hash: 9f132019696fbe9de6bc5936d18a3140bde0c7e92c6013e6de70ad36a9e331de
Instruction Fuzzy Hash: 44F0EC757082564FCF11DA68D8445FEBFA9AF8516070C005BD550CB141D7354519C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 06A3ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f601c961309a3c2626af20a89b43fc84fe4db8698f3e318ea87d9ce6de2364
Instruction ID: 54f956b446a94a47a8708b44d10042c1a91c161da1ca25c2df9c7bfffbec80ee
Opcode Fuzzy Hash: 10f601c961309a3c2626af20a89b43fc84fe4db8698f3e318ea87d9ce6de2364
Instruction Fuzzy Hash: 42E092312013116FC3506B9AA458A9E7ADAFBC9351B01443CF20EC7281CE61280587A5

Uniqueness

Uniqueness Score: -1.00%

Function 06A35698 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3ad6090454c041dafeafdb21f8e39cc611499801bff594137327b0153dac9a
Instruction ID: c271468dc3bed2c59102312e0e783e783d432b1dcae73ab62b85116abf15c082
Opcode Fuzzy Hash: cf3ad6090454c041dafeafdb21f8e39cc611499801bff594137327b0153dac9a
Instruction Fuzzy Hash: 73E06DB211D321AFC341DB34AC04897BBEDEF91220B05886EF084CB141E731D841CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 06A3C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076d9ac3fea926f1a2335ec865d9ff9b85ee14f54171b9bc56bbc748e6a655c0
Instruction ID: 268c1e9490f715f0777377679cb21e37f24e706245212626d29784b21031b75b
Opcode Fuzzy Hash: 076d9ac3fea926f1a2335ec865d9ff9b85ee14f54171b9bc56bbc748e6a655c0
Instruction Fuzzy Hash: 24F09075501B058FD725DF26E408652BBF7FB88311B00C62EE98B82A10DB70B949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 06A3B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fef94db6b835bb06e675c674266ece725eed776b7b2b9620ca590202883770
Instruction ID: c5b2ddfd557b694dd76df6fb2f2f3fb15b535d9543761d950de265a12953b2fb
Opcode Fuzzy Hash: f6fef94db6b835bb06e675c674266ece725eed776b7b2b9620ca590202883770
Instruction Fuzzy Hash: 6EF03975D0120CBFCB01DFB4E9589CDBFB9FB44200F1042A6E905E3240EA306B45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A3C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f3a06b1ad25cb9ee72960244f278af90aa34b33753766f3cc4a4e0a286b756
Instruction ID: 399ad7ec31b7d069288f79e51746f6c0568b6aa8493cc3f86f8ed8bbbb34b646
Opcode Fuzzy Hash: 16f3a06b1ad25cb9ee72960244f278af90aa34b33753766f3cc4a4e0a286b756
Instruction Fuzzy Hash: 19E0A0302007654FC321EB29E41879E7BE6EB85216F040929E24687640CBA1BC018792

Uniqueness

Uniqueness Score: -1.00%

Function 06A3CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb056ece057a05a5959d8bd9fd15db2480aa655106b86fa41c38761a422bb7e2
Instruction ID: b4229f25f132233004a0ed6c88794e9c3c888b850e108690031812d0ea047849
Opcode Fuzzy Hash: bb056ece057a05a5959d8bd9fd15db2480aa655106b86fa41c38761a422bb7e2
Instruction Fuzzy Hash: 6FE048321063616FC652DB16FC14DDB3B65E786651B014155E109C7651DE381D8787D1

Uniqueness

Uniqueness Score: -1.00%

Function 06A3C185 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc7c2df21e84318459af6a9d381b73ef150dd24f149d3185be3f4392eec14e7
Instruction ID: f10c1bd85f2ed5c4d30bcbefa7c46385b5ea7ae99b411452c707d33eaafe7c2f
Opcode Fuzzy Hash: 6fc7c2df21e84318459af6a9d381b73ef150dd24f149d3185be3f4392eec14e7
Instruction Fuzzy Hash: 04F05E75501B058FD725DF22E048256BBF3FB88301B00C61DD98B82A54DB30B949CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06A3CE88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8012036ad2fe05e6fcfd61369ca091ee034528caa2e85eb81150de03ea54bb1a
Instruction ID: 31dce1d547bb694078ffaf32a53e36ed29aef766d185059284061139cc640297
Opcode Fuzzy Hash: 8012036ad2fe05e6fcfd61369ca091ee034528caa2e85eb81150de03ea54bb1a
Instruction Fuzzy Hash: 9DE02071407351BFC7429324B8145D53FA5EB432117158055FC49CB551DF380CC283D1

Uniqueness

Uniqueness Score: -1.00%

Function 06A3E280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9159cb52370bbc3c540418d6d86883b935a62920fd8ba00be28325628746b8
Instruction ID: a9cfa475497171ebb5cf9054d69877e901d88da7bcf1b8fd0374b3398163628a
Opcode Fuzzy Hash: 3f9159cb52370bbc3c540418d6d86883b935a62920fd8ba00be28325628746b8
Instruction Fuzzy Hash: 61E026324013226FC746A726BD115483BA1F75A300F020157EC09DB6B0CF280ECB8BE3

Uniqueness

Uniqueness Score: -1.00%

Function 06A3E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b69a9eebdc7d9a7ebce4020cea6fd319fdbeaa6f03c05a69de2fd06d58a3de
Instruction ID: 3c990344e67b93177aba052d50842f5702d68dd0d13deeeca48992bd418167e7
Opcode Fuzzy Hash: e9b69a9eebdc7d9a7ebce4020cea6fd319fdbeaa6f03c05a69de2fd06d58a3de
Instruction Fuzzy Hash: 89E02071909319FFCB02CF6CEC5049D3BF1EB8210572046D6D909D7290E5300F158751

Uniqueness

Uniqueness Score: -1.00%

Function 06A3AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6df85a7f8d0a23faec6a411ffd2dac32393f8682a821cb42fba8ba97d768f5
Instruction ID: 012fc76a92fd437ce058465036b3f4f6d75680ce3e30ccbbbb3e9afb51957ac8
Opcode Fuzzy Hash: 4d6df85a7f8d0a23faec6a411ffd2dac32393f8682a821cb42fba8ba97d768f5
Instruction Fuzzy Hash: FED02B71321325678645276EB4184BE37DBEBD42223004039EA0BC7340CE203C0683D5

Uniqueness

Uniqueness Score: -1.00%

Function 06A3B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795f87e9467438360f13e745b86151ec54cfb5805ee7c1d65e81800bab37c909
Instruction ID: fa3ff8f1a45018e7b18fae6cc87e49c9621430bb199c83111a7017610d7aafb9
Opcode Fuzzy Hash: 795f87e9467438360f13e745b86151ec54cfb5805ee7c1d65e81800bab37c909
Instruction Fuzzy Hash: BEE09275D0020CEFCB40DFE4E9449DDBBB9EB48200F1082AADA09A3200EB306B55DF81

Uniqueness

Uniqueness Score: -1.00%

Function 06A3E90D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e30569c95e4c84d66558ff26fdafe506e387a778ee9d9347edfcd87e3bf4a8
Instruction ID: 369ceb459f46ef4c57ba200d32ec08ce0475ac552f52d910bc8f3124d4e127de
Opcode Fuzzy Hash: 46e30569c95e4c84d66558ff26fdafe506e387a778ee9d9347edfcd87e3bf4a8
Instruction Fuzzy Hash: 26D01776A9A291DFC3836B74DA54A813F76AF47251B1940C2E484CF177D2264C18DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 06A3E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0563df809a2d72f0ff7ec09b52f8f81d601ea73e9347fc19a89131803c2284d
Instruction ID: be2be01282bf777c7fbf08ea6b7f7f16ea6a4f8d08a4cfa1c85a169427ae6b96
Opcode Fuzzy Hash: e0563df809a2d72f0ff7ec09b52f8f81d601ea73e9347fc19a89131803c2284d
Instruction Fuzzy Hash: BDD05EB2A0120DFFCB41DFACE90095DB7FAEB84205B1089A9D90DE7200EA312F009B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A3F8EA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec3910216d86669f834a1c36efcd520a3e96caa97a5c2f5ef11b9d929d95e2f
Instruction ID: ffb7db3c6e86d439ad1000278d1098bea100ac2d00654d4fc608dafeeabc338d
Opcode Fuzzy Hash: 2ec3910216d86669f834a1c36efcd520a3e96caa97a5c2f5ef11b9d929d95e2f
Instruction Fuzzy Hash: EEC012727002210B8284A6AC703006D76D7B7C82A3386402BEB0EC3388CD609C424385

Uniqueness

Uniqueness Score: -1.00%

Function 06A33721 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7a5bd9310860675e39771a884542da3661789edb513ce505660de8553080b5
Instruction ID: 2d2f980c5ec12e3cfb5fcd10d60c82141111bc39b3b9116cdefa99b9e33a9cda
Opcode Fuzzy Hash: fa7a5bd9310860675e39771a884542da3661789edb513ce505660de8553080b5
Instruction Fuzzy Hash: 39C0123014A3A02FC71306202C05D977E269781B00B064086F2448B4D3C6614524D2F2

Uniqueness

Uniqueness Score: -1.00%

Function 06A3DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53389c5d0801d365bda2b3832f4101f355b949ff0f38db9772753f6517a1147
Instruction ID: f78418f1c829f989b2639b496c414419dae1010715bab6031a1c8f0e0821b354
Opcode Fuzzy Hash: e53389c5d0801d365bda2b3832f4101f355b949ff0f38db9772753f6517a1147
Instruction Fuzzy Hash: D4C09B7698B7D46EDF0217349C1D4857E567F9276171540D7F3418D062F7510505C791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06A36FE8 Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cb77c9c77e15b76bdc55c6d42be51e474e4fb28b59f4efd636abd6c9afdbd0
Instruction ID: 9b22137acc735fc5227e8a4b5bf8169c6c573ab89e6d34d50a65cc90ba7f01c6
Opcode Fuzzy Hash: 88cb77c9c77e15b76bdc55c6d42be51e474e4fb28b59f4efd636abd6c9afdbd0
Instruction Fuzzy Hash: F5621CB06103019FD789EF98D45872A7AD6FB84308F24C45CD10E8F396DBBAD94B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A36FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cebd69b5b64401c856f3118c29bc81d724709c12f97095d5959851fe69ea8e6
Instruction ID: ebacb2877b71d9b6252c3baa2b81364dd72186f2cc810cf5cf1c6a415c9a6637
Opcode Fuzzy Hash: 3cebd69b5b64401c856f3118c29bc81d724709c12f97095d5959851fe69ea8e6
Instruction Fuzzy Hash: FC621CB06103019FD789EF98D45872A7AD6FB84308F24C45CD10E9F396DBBAD94B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 07E14E37 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd0cf7257cd6ef9edb4f2e5f649d68cb9f656736cf3321a94f73d43e5febfdd
Instruction ID: f78078d922ba5281780761d0cd655e020d77cfdd2bfc9617a2b03d9b8772c79e
Opcode Fuzzy Hash: cdd0cf7257cd6ef9edb4f2e5f649d68cb9f656736cf3321a94f73d43e5febfdd
Instruction Fuzzy Hash: CED1F931C2075ADACB11EBA4D950699B7B1FFE5300F11CB9AE0093B624EB706ED5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07E14E48 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54f1223a8a6aa2808a8345a525c28b6468859ac51f5a9e987a544e7a9f7c1b7
Instruction ID: 388fdfe2e44988be0717802efe5694e966c07c189baa880fca7043f178575c4e
Opcode Fuzzy Hash: e54f1223a8a6aa2808a8345a525c28b6468859ac51f5a9e987a544e7a9f7c1b7
Instruction Fuzzy Hash: 87D1E935C2075ADACB11EBA4D950699B7B1FFE5300F20CB9AD10937624EB706EC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055DDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812091456.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7dbf741ffa2e0891d6e00d1f24bf9bc0edd0f7ad439a6412b88a1798a4b928
Instruction ID: c46ee458bac9231d9cde7d7debc2248cac361c95b63807ab0f9fa02eb35c18f9
Opcode Fuzzy Hash: 1c7dbf741ffa2e0891d6e00d1f24bf9bc0edd0f7ad439a6412b88a1798a4b928
Instruction Fuzzy Hash: 82A16036F0021A8FCF15DFB9C8445AEFBB2FF84300B15856AE806AB265DB71D955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07E1A2DD Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819310481.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e10000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0455608ccb60d6775f59849238a71eff1a0a655a4200079532dfc67adb96eb0
Instruction ID: 03b486fe363bd6232dc87d5bd6100a249af279db8a871c41b8bb66ca62a14a80
Opcode Fuzzy Hash: e0455608ccb60d6775f59849238a71eff1a0a655a4200079532dfc67adb96eb0
Instruction Fuzzy Hash: 0791A5B0D012298FDB69DF69C9517DEBBB2BF88300F10C1EAC509AB294DB355A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A3ED10 Relevance: 5.2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

Strings

(_dq, xrefs: 06A3EF79
(_dq, xrefs: 06A3ED7A
(_dq, xrefs: 06A3EDF9
(_dq, xrefs: 06A3EEFA

Memory Dump Source

Source File: 00000000.00000002.1814073839.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_44QHzbqD3m.jbxd

Similarity

API ID:
String ID: (_dq$(_dq$(_dq$(_dq
API String ID: 0-2092114380
Opcode ID: 9091919396cfc4c2e3755340c6e8c5cc0dc3dbd984b47af89551644aef28b417
Instruction ID: 9cb787ce2a9f5bfe046d5cd4d055ae7481540f8f351345264e840c13c27b85ff
Opcode Fuzzy Hash: 9091919396cfc4c2e3755340c6e8c5cc0dc3dbd984b47af89551644aef28b417
Instruction Fuzzy Hash: C591B139A04355AFDB45AF78C4205AE7BF2FF85300B24856AE9069F381DA35DD06CBD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 44QHzbqD3m.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\44QHzbqD3m.exe.log

C:\Users\user\AppData\Local\Temp\Tmp7E50.tmp

C:\Users\user\AppData\Local\Temp\Tmp7E60.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
44QHzbqD3m.exe

Function 07E1CC28 Relevance: 6.6, Strings: 5, Instructions: 390
COMMON

Function 07E18D38 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1088
COMMON

Function 07E1AF90 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Function 07E16F90 Relevance: 2.7, Strings: 2, Instructions: 219
COMMON

Function 07E168E8 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Function 07E17930 Relevance: 2.7, Strings: 2, Instructions: 190
COMMON

Function 06A20D80 Relevance: 20.6, Strings: 16, Instructions: 619
COMMON

Function 06A21577 Relevance: 7.8, Strings: 6, Instructions: 342
COMMON

Function 055DAE30 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON