Edit tour

Windows Analysis Report
ExAXLXWP9K.exe

Overview

General Information

Sample name:	ExAXLXWP9K.exe renamed because original name is a hash value
Original sample name:	ca28053841e7d7e6b42f7b7dd38b0f50.exe
Analysis ID:	1431008
MD5:	ca28053841e7d7e6b42f7b7dd38b0f50
SHA1:	c9569814c98db8abb4aab100ab2eea649eeb9af8
SHA256:	4ae2e13993a8ef1fbaf538b4da18eca6e0b5ada918cbeb256c8490f6fc3b34fc
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ExAXLXWP9K.exe (PID: 616 cmdline: "C:\Users\user\Desktop\ExAXLXWP9K.exe" MD5: CA28053841E7D7E6B42F7B7DD38B0F50)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ExAXLXWP9K.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2024404772.00000000006B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ExAXLXWP9K.exe PID: 616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ExAXLXWP9K.exe PID: 616	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ExAXLXWP9K.exe.6b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 103.113.70.99 - Destination IP: 192.168.2.5

Timestamp:	04/24/24-13:07:10.061010
SID:	2043234
Source Port:	2630
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-13:07:28.632979
SID:	2043231
Source Port:	49704
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 103.113.70.99 - Destination IP: 192.168.2.5

Timestamp:	04/24/24-13:07:20.396167
SID:	2046056
Source Port:	2630
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-13:07:06.715468
SID:	2046045
Source Port:	49704
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: ExAXLXWP9K.exe

Malware Configuration Extractor: RedLine {"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Multi AV Scanner detection for submitted file

Source: ExAXLXWP9K.exe

Virustotal: Detection: 62%

Perma Link

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F0104 CryptUnprotectData,		0_2_079F0104
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F0680 CryptUnprotectData,		0_2_079F0680

Source: ExAXLXWP9K.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ExAXLXWP9K.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 4x nop then jmp 079F97A5h		0_2_079F93D8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 4x nop then jmp 079F97A5h		0_2_079F93C8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 103.113.70.99:2630 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 103.113.70.99:2630 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 103.113.70.99:2630

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 103.113.70.99:2630

Source: Joe Sandbox View

IP Address: 103.113.70.99 103.113.70.99

Source: Joe Sandbox View

ASN Name: NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN

Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99

Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: ExAXLXWP9K.exe, 00000000.00000002.2350066133.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: ExAXLXWP9K.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp9FF3.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA004.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_028925D8	0_2_028925D8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_0289DC74	0_2_0289DC74
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_04FA6948	0_2_04FA6948
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_04FA7C20	0_2_04FA7C20
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_04FA0040	0_2_04FA0040
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_04FA001C	0_2_04FA001C
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_04FA7C12	0_2_04FA7C12
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_04FA5A43	0_2_04FA5A43
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062E3838	0_2_062E3838
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062F67D8	0_2_062F67D8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062FA3E8	0_2_062FA3E8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062F3F50	0_2_062F3F50
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062FA3D8	0_2_062FA3D8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062F6FE8	0_2_062F6FE8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062F6FF8	0_2_062F6FF8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F87C8	0_2_079F87C8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F66B8	0_2_079F66B8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079FB460	0_2_079FB460
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F6B38	0_2_079F6B38
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F7230	0_2_079F7230
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F3998	0_2_079F3998
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F4960	0_2_079F4960
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F5888	0_2_079F5888
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F8070	0_2_079F8070
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F6060	0_2_079F6060
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F4FB8	0_2_079F4FB8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F93D8	0_2_079F93D8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F93C8	0_2_079F93C8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F6B28	0_2_079F6B28
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F2AF0	0_2_079F2AF0
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F2AE0	0_2_079F2AE0
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F3989	0_2_079F3989
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F21D8	0_2_079F21D8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F21C8	0_2_079F21C8
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F494F	0_2_079F494F
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F6050	0_2_079F6050
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F5878	0_2_079F5878

Source: ExAXLXWP9K.exe, 00000000.00000000.2024430330.00000000006F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUpspearing.exe8 vs ExAXLXWP9K.exe
Source: ExAXLXWP9K.exe, 00000000.00000002.2349530812.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ExAXLXWP9K.exe
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs ExAXLXWP9K.exe
Source: ExAXLXWP9K.exe	Binary or memory string: OriginalFilenameUpspearing.exe8 vs ExAXLXWP9K.exe

Source: ExAXLXWP9K.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp9FF3.tmp

Jump to behavior

Source: ExAXLXWP9K.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ExAXLXWP9K.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002C88000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002C0B000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002C9E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ExAXLXWP9K.exe

Virustotal: Detection: 62%

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ExAXLXWP9K.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ExAXLXWP9K.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ExAXLXWP9K.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: ExAXLXWP9K.exe

Static PE information: 0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062E1DAF push FFFFFF8Bh; retf	0_2_062E1DB1
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062FE060 push es; ret	0_2_062FE070
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_062FECF2 push eax; ret	0_2_062FED01
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Code function: 0_2_079F8D18 push eax; retf	0_2_079F8D41

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Memory allocated: 2820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Memory allocated: 29F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Memory allocated: 49F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Window / User API: threadDelayed 2508

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe TID: 4372	Thread sleep time: -10145709240540247s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe TID: 4144	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ExAXLXWP9K.exe, 00000000.00000002.2372865317.00000000066AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: ExAXLXWP9K.exe, 00000000.00000002.2367817241.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Users\user\Desktop\ExAXLXWP9K.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: ExAXLXWP9K.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ExAXLXWP9K.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2024404772.00000000006B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ExAXLXWP9K.exe PID: 616, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\ExAXLXWP9K.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ExAXLXWP9K.exe PID: 616, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: ExAXLXWP9K.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ExAXLXWP9K.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2024404772.00000000006B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ExAXLXWP9K.exe PID: 616, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ExAXLXWP9K.exe	63%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://purl.oen	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15V	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15V	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AE7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://purl.oen	ExAXLXWP9K.exe, 00000000.00000002.2350066133.000000000116E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	ExAXLXWP9K.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	ExAXLXWP9K.exe, 00000000.00000002.2350762263.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	ExAXLXWP9K.exe, 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.113.70.99	unknown	India		133973	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431008
Start date and time:	2024-04-24 13:06:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ExAXLXWP9K.exe renamed because original name is a hash value
Original Sample Name:	ca28053841e7d7e6b42f7b7dd38b0f50.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:07:26	API Interceptor	15x Sleep call for process: ExAXLXWP9K.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.113.70.99	44QHzbqD3m.exe	Get hash	malicious	RedLine	Browse
	3q1lESMAMh.exe	Get hash	malicious	RedLine	Browse
	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	44QHzbqD3m.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	3q1lESMAMh.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	https://www.wsj.pm/download.php	Get hash	malicious	NetSupport RAT	Browse	103.113.70.37
	3A8YbQ0RZ7.dll	Get hash	malicious	Qbot	Browse	103.113.68.33
	onuxDag8Co.exe	Get hash	malicious	LummaC Stealer, RedLine, SectopRAT	Browse	103.113.68.183
	wssays.exe	Get hash	malicious	Unknown	Browse	103.113.70.18

Process:	C:\Users\user\Desktop\ExAXLXWP9K.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:56 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4510367916039364
Encrypted:	false
SSDEEP:	48:8SOl2dfTXddRYrnvPdAKRkdAGdAKRFdAKRE:8SOlOG
MD5:	14D091663C73CCE23EADFBEAF860A986
SHA1:	2C1E133DA317B23A955C1074822C447434AF819B
SHA-256:	8264443A11D312AABF8D6A571C49B0FC6385030EC013C4EB68F41527CA8CE2C8
SHA-512:	1891BA89B1FD1203832FE7A8E54026D1FC9D9D741F305796710FB3D709822591DFBF39DC5D16C2D33478F8E27D7B9B1D8882EFEF454E6B924CFA8A9E3534FEF9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.......n.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ExAXLXWP9K.exe.log

Download File

Process:	C:\Users\user\Desktop\ExAXLXWP9K.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp9FF3.tmp

Download File

Process:	C:\Users\user\Desktop\ExAXLXWP9K.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpA004.tmp

Download File

Process:	C:\Users\user\Desktop\ExAXLXWP9K.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\ExAXLXWP9K.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.069507606347515
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ExAXLXWP9K.exe
File size:	312'332 bytes
MD5:	ca28053841e7d7e6b42f7b7dd38b0f50
SHA1:	c9569814c98db8abb4aab100ab2eea649eeb9af8
SHA256:	4ae2e13993a8ef1fbaf538b4da18eca6e0b5ada918cbeb256c8490f6fc3b34fc
SHA512:	c86f17323b43391c7a9b746787a7de607f4bf470be6c34827787c227301594a48a8fa3c49d4ac310d3fee7e6ba62754a151ee1ead15c87890637cd335802e301
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
TLSH:	25645C1823EC8911E27F4B7994A1E274D375ED56A452E30F4ED06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F72A87DD742h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F72A87DD742h
jnc 00007F72A87DD742h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F72A87DD742h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F72A87DD742h
je 00007F72A87DD742h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F72A87DD742h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F72A87DD742h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b95c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b940	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e994	0x2ec00	64c48738b5efa1379746874c338807d5	False	0.4696168950534759	data	6.205450376900145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9d4	0x1cc00	5b3e8f48de8a05507379330b3cf331a7	False	0.23725373641304348	data	2.6063301335912525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	f921873e0b7f3fe3399366376917ef43	False	0.025390625	data	0.05390218305374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x35a	data	0.4417249417249417
RT_MANIFEST	0x4e7e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-13:07:10.061010	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2630	49704	103.113.70.99	192.168.2.5
04/24/24-13:07:28.632979	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	2630	192.168.2.5	103.113.70.99
04/24/24-13:07:20.396167	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2630	49704	103.113.70.99	192.168.2.5
04/24/24-13:07:06.715468	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49704	2630	192.168.2.5	103.113.70.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 13:06:57.828517914 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:06:58.840449095 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:00.287190914 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:00.287336111 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:00.297216892 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:00.390374899 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:00.390568018 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:03.309365034 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:03.677241087 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:03.721246004 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:06.540352106 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:06.540489912 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:06.715467930 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:07.236264944 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:07.277919054 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:10.061009884 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:10.061088085 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:13.089145899 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:16.090341091 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:16.341633081 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:16.341684103 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:16.341718912 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:16.341753006 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:16.341801882 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:16.341828108 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:20.396167040 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:20.396404982 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:20.629538059 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:20.684067965 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:20.760421991 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:20.982624054 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:21.027918100 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:21.040200949 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:21.259939909 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:21.260024071 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:21.260056019 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:21.260121107 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:21.496957064 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:21.497030973 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:21.759102106 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:21.801986933 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:21.812004089 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:22.044074059 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:22.045041084 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:22.090315104 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:22.269030094 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:22.490698099 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:22.498579025 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:22.720134974 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:22.762190104 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:22.870321035 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:23.115148067 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:23.119703054 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:23.359921932 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:23.368616104 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:23.597274065 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:23.605423927 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:23.880048990 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:23.881105900 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:24.101741076 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:24.130460978 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:24.351481915 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:24.353718042 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:24.584884882 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:24.587914944 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:24.871433020 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:24.918231010 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.151273012 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.199661016 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.262540102 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.487926006 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.487951040 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.487962961 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.487977028 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.488066912 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.714811087 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.714976072 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.715049028 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.715188980 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.715604067 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.715617895 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.715646029 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.715941906 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.716022015 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.934804916 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.934828997 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.934910059 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.935945034 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.935960054 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936074972 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936387062 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936507940 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936518908 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936532974 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936546087 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.936639071 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.936714888 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.936841965 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942222118 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942327023 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942339897 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942353010 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942476034 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942492008 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:25.942682028 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:25.942749023 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.158763885 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.159018993 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.159250975 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.159547091 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.159801960 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.160012007 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.160322905 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.160378933 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.162457943 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.162646055 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.162673950 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.162797928 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.162962914 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.163018942 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.164155006 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.164207935 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.164514065 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.164525032 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.164792061 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.164947033 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.165059090 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.165262938 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.165471077 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.165482044 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.165688992 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.165730953 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.397839069 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.400113106 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.400125980 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.400374889 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.400594950 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.400854111 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.400942087 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.401019096 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.401216030 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.401318073 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.401384115 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.401405096 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.401417971 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.406512976 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.406620979 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.410202026 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.418257952 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.419135094 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.419189930 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.633754969 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.634068012 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.634143114 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.634275913 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.634469032 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.634566069 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.634799004 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.634866953 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.653554916 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.653675079 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.653738976 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.653935909 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.654062033 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.654237986 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.654283047 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.654499054 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:26.856986046 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857021093 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857170105 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857258081 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857270002 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857336044 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857441902 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857629061 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857640982 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857803106 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.857889891 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874383926 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874433994 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874469995 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874505997 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874619961 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874696016 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874800920 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.874912977 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875008106 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875041008 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875211000 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875411034 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875448942 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875581026 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875670910 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.875814915 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.877770901 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:26.881746054 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:27.104923010 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:27.152795076 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:27.764765024 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:28.029571056 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:28.158344030 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:28.160244942 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:28.401959896 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:28.402612925 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:28.623723984 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:28.632978916 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:28.855037928 CEST	2630	49704	103.113.70.99	192.168.2.5
Apr 24, 2024 13:07:28.902801037 CEST	49704	2630	192.168.2.5	103.113.70.99
Apr 24, 2024 13:07:29.098176956 CEST	49704	2630	192.168.2.5	103.113.70.99

Target ID:	0
Start time:	13:06:56
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\ExAXLXWP9K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ExAXLXWP9K.exe"
Imagebase:	0x6b0000
File size:	312'332 bytes
MD5 hash:	CA28053841E7D7E6B42F7B7DD38B0F50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.2024404772.00000000006B2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2350762263.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.3%
Total number of Nodes:	133
Total number of Limit Nodes:	10

Executed Functions

Function 079F87C8 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 079F8ABC
1, xrefs: 079F8B37

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: a2581f633aea67abcb46b77952715335c5e1f291d41497e0e17ce49b952f078a
Instruction ID: 79d420c8cdc248a170c6a10b6609b1fa012ffbe90066848e1e5abbf46887f1d3
Opcode Fuzzy Hash: a2581f633aea67abcb46b77952715335c5e1f291d41497e0e17ce49b952f078a
Instruction Fuzzy Hash: 7ED1C074E01218CFDB68DFA5C990B9DB7B2BF89304F2085A9C509AB354DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F3998 Relevance: 2.8, Strings: 2, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N'uq, xrefs: 079F3A48
N'uq, xrefs: 079F3A7B

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: N'uq$N'uq
API String ID: 0-2047261738
Opcode ID: 12fc9661a776a8602ee8e948c7fa3e3944b3ce65bbeb450cbf5d32b12ca332f4
Instruction ID: f8ab01af6c84fef5876ecc29c176130c8c15837228c7045681bf562e6d6fa8f6
Opcode Fuzzy Hash: 12fc9661a776a8602ee8e948c7fa3e3944b3ce65bbeb450cbf5d32b12ca332f4
Instruction Fuzzy Hash: C0C1E2B4E01219CFDB14DFA9C944B9EFBB6BF84305F14C5A9D808AB255CB349985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 079F3989 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N'uq, xrefs: 079F3A48
N'uq, xrefs: 079F3A7B

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: N'uq$N'uq
API String ID: 0-2047261738
Opcode ID: 92702649cdbbae160b53180205cb8c7a590329cc14585157c2f229b7a59eef01
Instruction ID: b994765fa657e2564d88cce5cf35e15e91517df87610fd09dd6f530577599654
Opcode Fuzzy Hash: 92702649cdbbae160b53180205cb8c7a590329cc14585157c2f229b7a59eef01
Instruction Fuzzy Hash: 4481B3B0D012198FEB14DFAAC948B9EFBF6BF84314F14C0A9D508AB265DB749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F7230 Relevance: 1.9, Strings: 1, Instructions: 644
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 079F7623

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 9fa8772d3a623e7d3b77fe68285c339e99f834cfbd155c4d8fdb18e633ed584d
Instruction ID: 3c78e5d76c118c6bba7816e35d5af621c01eec4c3e28e7ee353ad88388e1c704
Opcode Fuzzy Hash: 9fa8772d3a623e7d3b77fe68285c339e99f834cfbd155c4d8fdb18e633ed584d
Instruction Fuzzy Hash: BE424BB0D0426ACFDB14DFA5C8407EDFBB2BF89304F5085AAD549AB240EB749A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 062F3F50 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 062F41E4

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 36bcf1e93fec7e7f329f6a8bf4fe006a10cd40eaa02fc1b100579b174055d671
Instruction ID: e084283c601376d98c056d948de9a97a0fbef9a69d27afec25a6dd8f6f9a5006
Opcode Fuzzy Hash: 36bcf1e93fec7e7f329f6a8bf4fe006a10cd40eaa02fc1b100579b174055d671
Instruction Fuzzy Hash: 06128134B202058FDB54DF78C594A9EBBF6BF88710B148169D906EB365DB70EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 079F0680 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 079F06ED

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 0d999d1dc66f73fa504fe9495495a74fa36d21cafcd2aeb86854d9d652dc6acf
Instruction ID: 798c357c0ca59d9abe2ee3ebe193606754213644a30297b13ae651ea4f057a21
Opcode Fuzzy Hash: 0d999d1dc66f73fa504fe9495495a74fa36d21cafcd2aeb86854d9d652dc6acf
Instruction Fuzzy Hash: FB113AB28002499FDB10DF99C945BEEBFF9EF48320F148419E614A7211D339A550DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 079F0104 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 079F06ED

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: dfe984a560ca65f8476c06769cfc37a089f5cf276038a8f3d1fe4d5e77212f25
Instruction ID: 2c401d1277f11155794e613498946a9e017ed814273ce5f05443df4b31195a0c
Opcode Fuzzy Hash: dfe984a560ca65f8476c06769cfc37a089f5cf276038a8f3d1fe4d5e77212f25
Instruction Fuzzy Hash: 471156B28002499FDB10DF99C844BEEBFF9EF48324F108419EA18A7211C339A550CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062E3838 Relevance: 1.0, Instructions: 1022COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3df4c6205d33c93c96db8aa4231666fbde5303b24d744d2d6d7f28ae790d172
Instruction ID: 134f4b86ca16a62d6c36e74b9622761a101f848e164622bc958af98397302fb0
Opcode Fuzzy Hash: f3df4c6205d33c93c96db8aa4231666fbde5303b24d744d2d6d7f28ae790d172
Instruction Fuzzy Hash: DC827D30B502159FCB44DF68C994EAEBBF6EF88700F1580AAE506DB3A5CA71DD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 079FB460 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb1724cc7ba084d3585def045ca6f8241a554a9b4bcebdb02413ee24f3dd8bd
Instruction ID: c850f78efb50afd3b39f6d8afff57912c4c3a9e2a7f2a22b5190f060d6faadfa
Opcode Fuzzy Hash: bdb1724cc7ba084d3585def045ca6f8241a554a9b4bcebdb02413ee24f3dd8bd
Instruction Fuzzy Hash: BD2268B47016058FDB19DF79C590BAEB7FAAF89708F248469D605DB3A0CB34E901CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04FA6948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccf14544a45e1009e738113131a19313af3a6cc701bc9e1643b87cbb939732d
Instruction ID: 0603723d47f415c8232ab26f6a47754b1d9ebfaedb92fd1b11a1d446c6dd6957
Opcode Fuzzy Hash: 9ccf14544a45e1009e738113131a19313af3a6cc701bc9e1643b87cbb939732d
Instruction Fuzzy Hash: ED22D175940228CFDB65DF64C958BD9BBB2FF8A301F0080E9D509AB2A1DB359E85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 062F67D8 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b9970df5353c2a30eac0f5f271d126d9b06850c48294506d125d7a7509e919
Instruction ID: 04c9bc064d4399725cc560b2d3c6b32d3521c27ea894d9ffca8d8511d6f13981
Opcode Fuzzy Hash: 64b9970df5353c2a30eac0f5f271d126d9b06850c48294506d125d7a7509e919
Instruction Fuzzy Hash: 04F1B230A202099FDB05DF68D984B9EBBF6EF84310F148579E905EB2A1DB35ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 079F5888 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2874d75d43697c4972269c6c041773ba6d231430b269dabbc9994322fe669566
Instruction ID: 0dd7f3de253e2d3266156597c6d6e16cfa7f8defd6d7919f6dcb1aae75a236d5
Opcode Fuzzy Hash: 2874d75d43697c4972269c6c041773ba6d231430b269dabbc9994322fe669566
Instruction Fuzzy Hash: 3DF1A0B4E01229CFDB64DFA5D884B9DBBB2BF49305F1085AAD50AA7350DB319E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F6060 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2367d4ef02340fd772c82ebedc2b3e34191776b5b51ab8fb9919a5e9fb99f54d
Instruction ID: 996151f39fa6eda5891946b244a6a16d717f968cb3d44c7c1f3e5818770b7a35
Opcode Fuzzy Hash: 2367d4ef02340fd772c82ebedc2b3e34191776b5b51ab8fb9919a5e9fb99f54d
Instruction Fuzzy Hash: F9E1A3B4E00229CFDB65DFA9C850BDDBBB2BF49300F1081AAC50AA7255DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F8070 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fefee4c3a10e03ef8ca6ae5744b155b9ca39a5e47574f34bb0415e553f4685e
Instruction ID: e7fc90e0768acc37d1b19875f259b6c30348971f537b192bf145073b5f467d1c
Opcode Fuzzy Hash: 3fefee4c3a10e03ef8ca6ae5744b155b9ca39a5e47574f34bb0415e553f4685e
Instruction Fuzzy Hash: 6EE1A0B4E01229CFDB64DF65C994B9DBBB2BF89304F1085EAC50AAB250DB305E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 062FA3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dda1bdf647639556ed240540d81760a36f756128dabd8710668a61450786679
Instruction ID: 018549c4bd429263a49929bf3020138b1d5b3d68616bc88d7f77be2d4e381884
Opcode Fuzzy Hash: 3dda1bdf647639556ed240540d81760a36f756128dabd8710668a61450786679
Instruction Fuzzy Hash: EBD1E534D00318CFCB19EFB5D898A9DBBB2FF8A305F1081A9E54AA7254DB315986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 062FA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b23c90ec4cca003776cb6cb434d8fc26d082322eb99969ed6f1b53019d5b4fb
Instruction ID: 4b2f2d2a3da077d6bedadc1f4e33f23eb5d16eabab984246f4a11db3da6d5f47
Opcode Fuzzy Hash: 1b23c90ec4cca003776cb6cb434d8fc26d082322eb99969ed6f1b53019d5b4fb
Instruction Fuzzy Hash: A5D1E734D00318CFCB18EFB5D89869DBBB2FF8A315F1081A9E50AA7254DB355986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04FA7C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5e9c59cab133c6b854d4dec84099adf13eee615329a8adf3bfa5ad07e95b59
Instruction ID: 20afb3e7ac2ee3cbab574ad757c59f3be78fe1066d251409f13c4bf4987f64cd
Opcode Fuzzy Hash: 9d5e9c59cab133c6b854d4dec84099adf13eee615329a8adf3bfa5ad07e95b59
Instruction Fuzzy Hash: 28C1A574E00218CFDB14DFA9D984A9EBBB6FF89304F10C1A9D409AB355DB34A986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 079F4960 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3884dd06e1188954452ddbf9bce1dad1cda19f4a80c79dd9f886864d4848d4eb
Instruction ID: 13d9badc6e9f951b0eb626bb32e12ba4c20d4a7c72c4ed4ec24b0f046f7ae947
Opcode Fuzzy Hash: 3884dd06e1188954452ddbf9bce1dad1cda19f4a80c79dd9f886864d4848d4eb
Instruction Fuzzy Hash: F7C1B374E022189FDB44DFA9D594AEEBBF2FF88300F209069E905AB355DB349A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F66B8 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b3e0baf267e68bfbbb2ac55f9044efdbbefea94f03d160eb78ee51ebb323f5
Instruction ID: f27b803c37148b510ca2bc698664d6b4b256fc5add693be60a412f704190df5f
Opcode Fuzzy Hash: e6b3e0baf267e68bfbbb2ac55f9044efdbbefea94f03d160eb78ee51ebb323f5
Instruction Fuzzy Hash: CEB1BEB4E01318CFDB68DFA5D944A9DBBB2BF89304F2084A9C509AB355DB359D86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 079F494F Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41633649c43c6c3194ec79134e4f98824bf0e9f0fe8731d31b4e3f3af53ea6e
Instruction ID: 915d60a2f9303550397e9455d5aefa9b8fd573cd3667b1d0eacb4fd26968dfee
Opcode Fuzzy Hash: b41633649c43c6c3194ec79134e4f98824bf0e9f0fe8731d31b4e3f3af53ea6e
Instruction Fuzzy Hash: 31A1C374E022089FDB44DFA9D594AEEBBF2FF89300F209069E505AB365DB349A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F6B38 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bc08548773d1023d1df8530b4b7734469730bb88801c0e046ede0d2de536c7
Instruction ID: 2b51b4f36b6c1f36dc963e6652e12cd4fac3e287e48aec73bebf3cce0da5a260
Opcode Fuzzy Hash: b2bc08548773d1023d1df8530b4b7734469730bb88801c0e046ede0d2de536c7
Instruction Fuzzy Hash: 1FA1C274E01318CFDB24DFA9D884A9DBBB2FF8A314F1094A9D509AB354DB359986CF00

Uniqueness

Uniqueness Score: -1.00%

Function 04FA5A43 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3187ba47d2032cdff15a2e318a28d98631e0f56fa2bd4f0402120ab628e6ad9c
Instruction ID: 9ca087eb93ff694feb030c4d84161ff3733c1b1380d2c1b0e7fc40b182823fd0
Opcode Fuzzy Hash: 3187ba47d2032cdff15a2e318a28d98631e0f56fa2bd4f0402120ab628e6ad9c
Instruction Fuzzy Hash: E4616574A00319DFDB04EFB4C9909DEBBF6FF89304B284125D409AB261EB30AD56CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04FA7C12 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7894728da37aa8a27c5f4b92f2369c2a9f523a4383a6216d0f92b42d0d8edd
Instruction ID: 1ac4fefba04a24231e1b0e9dca215aa73215aa596f3d4f36c6bd7da85edd6eae
Opcode Fuzzy Hash: db7894728da37aa8a27c5f4b92f2369c2a9f523a4383a6216d0f92b42d0d8edd
Instruction Fuzzy Hash: 7451D975E006188FEB18DFA6D944B9EBBB7BFC8304F14C0A9881DAB359DB3459468F50

Uniqueness

Uniqueness Score: -1.00%

Function 062E0D80 Relevance: 20.6, Strings: 16, Instructions: 619
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 062E0FB8
$]q, xrefs: 062E1430
$]q, xrefs: 062E13EB
$]q, xrefs: 062E0F86
$]q, xrefs: 062E0F36
$]q, xrefs: 062E1455
$]q, xrefs: 062E0FAC
$]q, xrefs: 062E13AC
$]q, xrefs: 062E1461
$]q, xrefs: 062E0E52
$]q, xrefs: 062E137B
$]q, xrefs: 062E0E84
$]q, xrefs: 062E0E02
$]q, xrefs: 062E0E78
$]q, xrefs: 062E13A0
$]q, xrefs: 062E1336

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2551331179
Opcode ID: 9915508134854803445d4519833b98834ec7764432d3fcd42951ddbd0305ac62
Instruction ID: 356c296053a7eaedc9b51769c73503fc638ba814ec5368214eb73c202b7a6e4c
Opcode Fuzzy Hash: 9915508134854803445d4519833b98834ec7764432d3fcd42951ddbd0305ac62
Instruction Fuzzy Hash: 3822F330B102059FDB449BA9C948A6EBBF6FF89700B54847AE906CB3A2CF74DC11CB51

Uniqueness

Uniqueness Score: -1.00%

Function 062E157B Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 062E18E3
$]q, xrefs: 062E1A88
$]q, xrefs: 062E1A7C
$]q, xrefs: 062E182E
$]q, xrefs: 062E1A57
$]q, xrefs: 062E1A12

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: f83362a0015a23aff236bc9b1ca5a0d2cd9108ec3c3193c211b4e839914e5af2
Instruction ID: 8980c88ea466c323da9042eebfc43f5d3943fb4c776b53fcba7d581c44400648
Opcode Fuzzy Hash: f83362a0015a23aff236bc9b1ca5a0d2cd9108ec3c3193c211b4e839914e5af2
Instruction Fuzzy Hash: 50C1F330B102019FDB549B68C858A7E7BEAEF85700F51457AEA028B3A2DFB4DC55C791

Uniqueness

Uniqueness Score: -1.00%

Function 062E0598 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

}lPj, xrefs: 062E059C

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: }lPj
API String ID: 0-3992993803
Opcode ID: 8006a5ac83e1d2940f6f8db2811edfc961149531a96110b0dd53985b12359b65
Instruction ID: e4e8faad0aed46a1a6be5c41ad1e12ee9815a64a66860bfd524f99391afd21ef
Opcode Fuzzy Hash: 8006a5ac83e1d2940f6f8db2811edfc961149531a96110b0dd53985b12359b65
Instruction Fuzzy Hash: 4002CC30B902058FDB549F68D454A6E7BA6FFC9704F414968D9029F3A1CFB9EC06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0289AE30 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0289B086

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5cac8a5eeaeb87bf99680257e218983ca1eed0528b12164c1281b7a766696b66
Instruction ID: 9d95c3ea2523b9bd4da41e067967043c3f746a842af2b145de4afcd1dd73427e
Opcode Fuzzy Hash: 5cac8a5eeaeb87bf99680257e218983ca1eed0528b12164c1281b7a766696b66
Instruction Fuzzy Hash: DF7134B8A00B058FDB28DF29D14475ABBF6FF88704F04892DD48AD7A50D775E84ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04FA4381

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c795fca06559bb7589a822d3fb270b96573cc9fe9d4a27bf7b58519eed5d3055
Instruction ID: 2c08c7b1b484fa90da6408a51b3e1525373a8501377aca6269b30fc3eca02733
Opcode Fuzzy Hash: c795fca06559bb7589a822d3fb270b96573cc9fe9d4a27bf7b58519eed5d3055
Instruction Fuzzy Hash: F04138B5A00309DFDB14DF99C488AAEBBF5FF88314F24C459D519AB361D375A842CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02895935 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 028959F1

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a12ab71f3211f7855cf51c0a421cab0058c3b99f2ab055a18798a8c7733c5fc4
Instruction ID: 402e758c253795aa64c42ca4e4c2f3deca87cac6c521c2f3d0878e2fb304a652
Opcode Fuzzy Hash: a12ab71f3211f7855cf51c0a421cab0058c3b99f2ab055a18798a8c7733c5fc4
Instruction Fuzzy Hash: 554101B4D00219CFEB24DFA9C984B9DBBF5FF48304F24806AD408AB250DB75694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 02894248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 028959F1

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 774855e45efd83429d0915356c410dde7815796a3c731f487b8ad1ccbd0dddc5
Instruction ID: 132860440db8fc615087f8370c4a910426cea071f10151b2b247240d0769a8af
Opcode Fuzzy Hash: 774855e45efd83429d0915356c410dde7815796a3c731f487b8ad1ccbd0dddc5
Instruction Fuzzy Hash: EC4102B4D00219CFEB25DFA9C984B9DBBF5FF44304F24805AD408AB250DB75694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 0289C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0289D2C6,?,?,?,?,?), ref: 0289D387

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7337970d7ca6bf1987005ad83ae617fa1e3b9b52e396b8530d81ff790e4ed9e2
Instruction ID: a78052fbaf8f6a8a8125dbcbcf09f8a73774db1a1e85d1ecba95d6f74da1ea12
Opcode Fuzzy Hash: 7337970d7ca6bf1987005ad83ae617fa1e3b9b52e396b8530d81ff790e4ed9e2
Instruction Fuzzy Hash: AF21E6B5900208DFDB10DF9AD584AEEBFF9FB48310F14801AE918A3310D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0289D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0289D2C6,?,?,?,?,?), ref: 0289D387

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f4bf1b3fee1ef5ef1dad1f8647e94ac9b2f1b916eaafc185da991645f9fa5105
Instruction ID: be3d6a4410682dfcf58dd60b39bbe0934968b984e9573127c37c4f90b4532617
Opcode Fuzzy Hash: f4bf1b3fee1ef5ef1dad1f8647e94ac9b2f1b916eaafc185da991645f9fa5105
Instruction Fuzzy Hash: 2521E3B59002189FDB10DFAAD584AEEBFF5EB48310F14801AE918A3210D378A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0289B2A0 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0289B101,00000800,00000000,00000000), ref: 0289B312

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cb6c11aa629a339d489d338e5a471c08b1ec21cdf7bb76eee12ac8c5e2c44caa
Instruction ID: f5210f02935d64509db20b477df300b74f09671bad66af1765b640f189df379a
Opcode Fuzzy Hash: cb6c11aa629a339d489d338e5a471c08b1ec21cdf7bb76eee12ac8c5e2c44caa
Instruction Fuzzy Hash: 191126B6D002498FDB10DFAAD484ADEFBF4EF48714F14842AD929A7600C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0289A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0289B101,00000800,00000000,00000000), ref: 0289B312

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6eac2eb3b67eaf5f76155678619155ebc0e1c93b782d82fb9d94009b26d57b00
Instruction ID: 3c4a6c79e395869c246532455c5071b4428d58978840ef852e99ab3dc68923c6
Opcode Fuzzy Hash: 6eac2eb3b67eaf5f76155678619155ebc0e1c93b782d82fb9d94009b26d57b00
Instruction Fuzzy Hash: 401114BA9003499FDB10DF9AD444AAEFBF8EF48314F14842ED919A7200C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0289B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0289B086

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5ad1b4faab4c2ab1a38619ba55b552597c3c2bf8ff8558a77536ced5a4ee373b
Instruction ID: 9780cfd198965330d0c8056b7a54179e6831ce9db5a7aa019694f2f8e9e307a9
Opcode Fuzzy Hash: 5ad1b4faab4c2ab1a38619ba55b552597c3c2bf8ff8558a77536ced5a4ee373b
Instruction Fuzzy Hash: A6110FB9C003498FDB20DF9AD444A9EFBF8AF88314F14841AD928A7210C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 079FA560 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 079FA5C5

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 56cf54bd00ddf0a1854d80ef7ef8e6dd0e459ef52aec1c83a10d4ebc0ac756a7
Instruction ID: 571b5210f239e28ef126ae385506536cd17b817143b85989494f6b3c1c181fbd
Opcode Fuzzy Hash: 56cf54bd00ddf0a1854d80ef7ef8e6dd0e459ef52aec1c83a10d4ebc0ac756a7
Instruction Fuzzy Hash: F01106B58003599FDB10DF99C885BDEBFF8EB48324F108419E518A7600C379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 079F9038 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 079FA5C5

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7f3a3bfcd181217dcf5a95292291af30419b9aa68910474aabde91155bc1f2ce
Instruction ID: 2fa0c5804c8fbbd7f2d84381a76aa7ac23d54174c2af2dc88901ee007ade6e11
Opcode Fuzzy Hash: 7f3a3bfcd181217dcf5a95292291af30419b9aa68910474aabde91155bc1f2ce
Instruction Fuzzy Hash: 6311F5B58003499FDB10DF99C484BEEBBF8EB49314F108419E518A7600C379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 062F3DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4']q, xrefs: 062F3F25

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 412cda977aee3d37b749702bdfbb3b1b0f7d37a0957c7e4bb40d98a8e1856721
Instruction ID: 808962d81aee0efa1a71d90ee17a60a1e7474f2eea139c942dd111e11dc3662f
Opcode Fuzzy Hash: 412cda977aee3d37b749702bdfbb3b1b0f7d37a0957c7e4bb40d98a8e1856721
Instruction Fuzzy Hash: DC313471B542104FCB19A778A49066E7BEBDFCA21070448BAE4498B795CE38EC0BC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 062F84D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4']q, xrefs: 062F85B1

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 8d26ea9811f94d7a2983154567f422e2796ef30ee44484af6730746a6cc1cd8b
Instruction ID: 7520e81e0ee764648484df9f0db73de5fc392da844c9ae8917f06938c63b70a6
Opcode Fuzzy Hash: 8d26ea9811f94d7a2983154567f422e2796ef30ee44484af6730746a6cc1cd8b
Instruction Fuzzy Hash: A3317F35B10205CFCB09EB78A5995AE76E7EFC82147504839E50ACB384EE39AC0787D1

Uniqueness

Uniqueness Score: -1.00%

Function 062F84C8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4']q, xrefs: 062F85B1

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: b063d638e70fd3675a301d9e9d59d4e503d9c7d9c76d2d4b948b3097f74f6ab5
Instruction ID: 2d2646e1739ab4cbcba9ed8ba89ea83f5be545ab8ee70f79a330d3a84a930272
Opcode Fuzzy Hash: b063d638e70fd3675a301d9e9d59d4e503d9c7d9c76d2d4b948b3097f74f6ab5
Instruction Fuzzy Hash: C721B134B10215CFCB09AB7895A957E3AE3AFC8204714483DE50ADB385EE38EC0787D2

Uniqueness

Uniqueness Score: -1.00%

Function 062FB358 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

4']q, xrefs: 062FB399

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a39dbd9bc9b957d381023672d346d3f5bc58e7084fd760f5947dda15922c0fe1
Instruction ID: f48f0f303cb294c08ce05180946f7038955b228735d8d654c7a516b42bc148e4
Opcode Fuzzy Hash: a39dbd9bc9b957d381023672d346d3f5bc58e7084fd760f5947dda15922c0fe1
Instruction Fuzzy Hash: 6401B134A09249EFCB05EF78E88448CBFB2FF44300B2004A9D586DB351DB305E45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 062F3EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4']q, xrefs: 062F3F25

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 780fe5aaa9293386d858611e82f94d6bc5315060db0c155fdc16aceefe59497e
Instruction ID: 2c53ff1189fbd08fd14b63af6949206388013eb51b4d31189f11d807b7457895
Opcode Fuzzy Hash: 780fe5aaa9293386d858611e82f94d6bc5315060db0c155fdc16aceefe59497e
Instruction Fuzzy Hash: 84F06D313401014FC61DBB2DE89496E7BEBEFC96103544969D00A8B2A8EE68FD0A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 062FB368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 062FB399

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: e67683140d9bd173cc51e10b21cc5b61a660652ea4065b2c99350a0665da4ab7
Instruction ID: 74d9184e0c5bf1c80bbcbcb4325486208e2f9bef3b53a6dda1c9b7374c5265aa
Opcode Fuzzy Hash: e67683140d9bd173cc51e10b21cc5b61a660652ea4065b2c99350a0665da4ab7
Instruction Fuzzy Hash: F3F03734A05209EFCB08FFB8E58899CBBB6FF84300B2045A9D90ADB754EB345E45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 062E2078 Relevance: 1.0, Instructions: 1043COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d4029dd677f4b3171ef0bce022eb4aa615b991b601744dad9f2d8c55373e7b
Instruction ID: edad990e2a21cc0a2e1140f09544ddf7d37df68785ce8f130785930e59be5497
Opcode Fuzzy Hash: 60d4029dd677f4b3171ef0bce022eb4aa615b991b601744dad9f2d8c55373e7b
Instruction Fuzzy Hash: E3926F70B402198FDB149B64CC50BEEBBB6EF88700F104599EA0AAB3A5DF719E41DF51

Uniqueness

Uniqueness Score: -1.00%

Function 062E1EC8 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0044302de515f90b10541c34f274596141a0815abbe14b536df1289d626b8a4c
Instruction ID: 6af90d564fa1945f98baa1168327d6790e64f1612e4fcc740ba59141dca32f40
Opcode Fuzzy Hash: 0044302de515f90b10541c34f274596141a0815abbe14b536df1289d626b8a4c
Instruction Fuzzy Hash: 6052B070B502158FDB149B24C994EAE77B6EFC8704F118499ED069B3A5CFB1EE42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 062E00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd42677fe3368f8d3f9c66aaa254a8d68bfc04f6e7004a21e679914bfea11cfa
Instruction ID: 90648f0682c671f8b1758aa86f930a28796b87150e8b2b6589392ec1e2866916
Opcode Fuzzy Hash: dd42677fe3368f8d3f9c66aaa254a8d68bfc04f6e7004a21e679914bfea11cfa
Instruction Fuzzy Hash: E742DE30B906158FCB65AF78D444A6E7AB6FFC5714B01096CC9039B394CFB9EC068B86

Uniqueness

Uniqueness Score: -1.00%

Function 062F48B8 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31bd592f750eb4f34c04fff4f3143b40bcbd1364c11842d282c5e3ad73edddd
Instruction ID: b0af399e8d2b5f401ec8ce15b78bdec0a043a1409ca03abb84dd9d456f27ecca
Opcode Fuzzy Hash: f31bd592f750eb4f34c04fff4f3143b40bcbd1364c11842d282c5e3ad73edddd
Instruction Fuzzy Hash: 23326D347206018FDB54EF29D598A5ABBF6FF88300B1584B9E906CB3A6DB74EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 062E0610 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df30caa84d81f831e22aa182387d53c08da37745be6c5104b44620e7607588d
Instruction ID: e07697b8f994fdeac66e80d21a22775c19c70e78ba41314063bdb66cdb84d023
Opcode Fuzzy Hash: 3df30caa84d81f831e22aa182387d53c08da37745be6c5104b44620e7607588d
Instruction Fuzzy Hash: 8B02DF30B902058FDB549B68C954B6E7BA6FFC9704F414869D9029F3A1CFB9EC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062E0700 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd8a9a4522a6a3bc4c6385f573b63de29b1455f26998ecd6a356d3530ef902b
Instruction ID: e04c12be228d8761ed1ed9bcad7c72b1ac01d178f8b187d0b6edd124c7e47f67
Opcode Fuzzy Hash: 2fd8a9a4522a6a3bc4c6385f573b63de29b1455f26998ecd6a356d3530ef902b
Instruction Fuzzy Hash: B2D1A034B602058FDB449B64C958B6A7BA6FFC9704F418469D9029F3A1CFB9EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062E00B8 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0ea71f464ad72c5a5d80e249efb02e16eb327d37dc61f81963772d6ae4ad1e
Instruction ID: acfccf76dc33a69f0023356663ee1ac08a1029d54afb629e9d8232c6a0439486
Opcode Fuzzy Hash: 2d0ea71f464ad72c5a5d80e249efb02e16eb327d37dc61f81963772d6ae4ad1e
Instruction Fuzzy Hash: 9BC19334B602059FDB849B64C958B6A7BA6FF89704F414065E902DF3A1CFF5DC12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062E067A Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83d2f94e1dcf892656e0f0a47395f5ec8290d6095d3fc8e3aa42b17e56ea048
Instruction ID: c0fc538e2061bd2edd27e8a054ee9a9d234ef36453595b52a9c6a4205916d316
Opcode Fuzzy Hash: a83d2f94e1dcf892656e0f0a47395f5ec8290d6095d3fc8e3aa42b17e56ea048
Instruction Fuzzy Hash: F2C1A334B602059FEB849B64C958B6976A6FFC9704F408065ED029F3A1CFF9EC52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062F48A8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5b5334f9e74b705dc1a94287707b5553ee22b32bf7ba31749acf594e3cfc88
Instruction ID: 2cafdde00fc5bce3924494d7dc929a57ab994342f6dfe51e0e46290e62af5dc4
Opcode Fuzzy Hash: 1b5b5334f9e74b705dc1a94287707b5553ee22b32bf7ba31749acf594e3cfc88
Instruction Fuzzy Hash: B6B14834B206058FDB44EF39D598A6ABBF6FF88304B1540A8E506DB3A6DB70EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 062F7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e965dd0ddf8fc78575c822b2f5fcefeae22095b51023687f8962349c3ce86f
Instruction ID: d2d3d2ee581415d80a212c11b134d878896a97a47def8d4ae84c30084f33eced
Opcode Fuzzy Hash: 50e965dd0ddf8fc78575c822b2f5fcefeae22095b51023687f8962349c3ce86f
Instruction Fuzzy Hash: F8513971E20219CFDB54DFA9E880BEEFBF6AF88700F14852AD915A7244DB749841CF80

Uniqueness

Uniqueness Score: -1.00%

Function 062E34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372624111.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6ceb1bc74ddce8f9f1e0decf05db5ffd154ad8124528a9ed403ee223bdd84c
Instruction ID: 825fa747b55991264e051f8c1001dad17cf81b38d3e12d48bf7725cc1503f409
Opcode Fuzzy Hash: 1f6ceb1bc74ddce8f9f1e0decf05db5ffd154ad8124528a9ed403ee223bdd84c
Instruction Fuzzy Hash: 60514735B506159FCB44CF69C88499EBBF2FF88710B118069E90AAB365DB70EC05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 062F7D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3437972b7d555b4729485c2d8bcb095dac3d95e8cef1b8c7a19f9566811059
Instruction ID: 97dddd552a2eccabf0a3e39c3ef336f97573df508af0e32f4a407d337f4c43a5
Opcode Fuzzy Hash: db3437972b7d555b4729485c2d8bcb095dac3d95e8cef1b8c7a19f9566811059
Instruction Fuzzy Hash: E25148B1D20219CFDB54CFA9E985BEDFBF5AF48700F14852AD915AB280DB749842CF81

Uniqueness

Uniqueness Score: -1.00%

Function 062F59C8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ba9268d9263ce823c01727b20927ddc6d4cbeeb3df860e7509e6431dfb224b
Instruction ID: 07d6735ed1c80249fdd8fd4b8f84f90419d91992783d72ece0830a18f3ae21ec
Opcode Fuzzy Hash: c2ba9268d9263ce823c01727b20927ddc6d4cbeeb3df860e7509e6431dfb224b
Instruction Fuzzy Hash: 3D415A35A20606DFCB14CF59C48096AFBF6FF89310B19C9A9EA55AB261D730F811CB90

Uniqueness

Uniqueness Score: -1.00%

Function 062F5579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d0cd270fa057c55298c85860a75270baa5f4cb6b869a653b513bdf42a423bb
Instruction ID: c89135e57f0b9f20319148016a2518957897130085103cfbcede5b70eff87281
Opcode Fuzzy Hash: c9d0cd270fa057c55298c85860a75270baa5f4cb6b869a653b513bdf42a423bb
Instruction Fuzzy Hash: 91318835B152119FDB05DF38D89496EBFB6BF89200B008469F9068B3A6DB34ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 062F5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea73fde203b51eeafa33acfd242a6f301ece9ceb3df98229296c5e1691eee3d
Instruction ID: 4f8cc03aaf3e5da29fec08df2108583a483811e24b688e1cc39b1e123a15518e
Opcode Fuzzy Hash: 0ea73fde203b51eeafa33acfd242a6f301ece9ceb3df98229296c5e1691eee3d
Instruction Fuzzy Hash: 05317534B112119FDB19DF38D89896EBBB6BF89301B018469F906CB3A5DB34ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 062F87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f1a4582c77e62614961ff1de4b4583d30f9a50c03906c35830703213471ac9
Instruction ID: d941869c096874a03a1e008ef578a6e3480524f5d574352900ff7fbd19851869
Opcode Fuzzy Hash: 59f1a4582c77e62614961ff1de4b4583d30f9a50c03906c35830703213471ac9
Instruction Fuzzy Hash: 0F41F2B1D1120CDFDB54DFAAD940ADEFFB6AF88310F10802AD919A7250DB34A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 062F8797 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701e08d3d63c37fef40da45d10ead2311c0607769ab048caee7f405e39c078d5
Instruction ID: b0c388ff3c549f18e2c2d5a3ded0f8bd455f93daa6b10f36399d0307d34c06fb
Opcode Fuzzy Hash: 701e08d3d63c37fef40da45d10ead2311c0607769ab048caee7f405e39c078d5
Instruction Fuzzy Hash: 8731F2B1D11209DFDB14DFA9D984ADEFFB6AF88300F14802AD515B7250DB389945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0278D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350164070.000000000278D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0278D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_278d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4b6e8ff4cae2f2ac1e2ec42d5a030c58df90e1ea57e989bf4fd60765d8d2d7
Instruction ID: f4af3b4f8e3c76627215b9bc12f4f9e0185ce0ee2630aadcc9f64aeeddf5a7ca
Opcode Fuzzy Hash: 3a4b6e8ff4cae2f2ac1e2ec42d5a030c58df90e1ea57e989bf4fd60765d8d2d7
Instruction Fuzzy Hash: 85214871640244DFDF25EF24D9C0F26BFA5FB88314F20C669E9091B296C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 062F8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33af426ee77bc792df11340d63edd3207c96c5d6bc5e626accf988f03e460cc4
Instruction ID: 343a324298f1ba41f6e33b1bcc4b9cfdbba3827fcee82123107cf5308ac4a302
Opcode Fuzzy Hash: 33af426ee77bc792df11340d63edd3207c96c5d6bc5e626accf988f03e460cc4
Instruction Fuzzy Hash: 1D3114B1D21218DFDF54DFA9D890ADEFBF9AF48310F14842AE909E7240C778A841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0278D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350164070.000000000278D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0278D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_278d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59c0f4bc0d44f1857189ccf7844c69457174039848e0f3de6a2ce36cf432610
Instruction ID: a10d77156b15a2140bc648e10dd763bdbf03ad5833f96ca017df99750bd273d4
Opcode Fuzzy Hash: d59c0f4bc0d44f1857189ccf7844c69457174039848e0f3de6a2ce36cf432610
Instruction Fuzzy Hash: EC2106B1580204DFDB29EF64D9C0F16BF65FB98324F20C569DD0D0B296C33AE456C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0279D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350201676.000000000279D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0279D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_279d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426585c743f58a83994f03b57cd19b3fe6b8114dc3e2893bcd8dc0880c5738df
Instruction ID: 53ac3126af1f619624cb708b2b3962aaaa8462ce82fd28d670f5502fb1c80e8c
Opcode Fuzzy Hash: 426585c743f58a83994f03b57cd19b3fe6b8114dc3e2893bcd8dc0880c5738df
Instruction Fuzzy Hash: 3521F271604304DFDF24EF28E9C4B26BF65FB88314F20C569D94A4B256C33AD407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 062F8A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059b8656ea4c0c7c85d6e26f3ba59d41abb6419bc02dc32fc8c8f31625fb4a04
Instruction ID: e4e9742dbdbcb96f194560b738e8198b4118323fbdd6292e0ba1c533fbf550ab
Opcode Fuzzy Hash: 059b8656ea4c0c7c85d6e26f3ba59d41abb6419bc02dc32fc8c8f31625fb4a04
Instruction Fuzzy Hash: 492113B1D212589FDB14CFA9C894B9EFFF9AF48300F14842AE505E7240D7789845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0279D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350201676.000000000279D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0279D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_279d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8dae75349ada00d977c492a2fe1bd4629512b1018676f82883c98f02189735
Instruction ID: bc21485207319bb1153311aeb1cdffc33100779a4d3652fb74c9a7c9a223c4e6
Opcode Fuzzy Hash: cf8dae75349ada00d977c492a2fe1bd4629512b1018676f82883c98f02189735
Instruction Fuzzy Hash: CC216F755093C08FDB12DF24D994715BF71EB46214F28C5DAD8898F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0278D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350164070.000000000278D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0278D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_278d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 5fb6ce95eda25cf2281a45074d08ad44176806c6fc15b39bc2bfa43077c86e13
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: EB21AF76544280DFDF16DF10D9C4B16BF72FB88314F24C6A9D9490B296C33AD426DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 062FBC5F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce60b4d0df5c0b0c6240fc9f83428cd15d69f2121c044c7f35762063f50825ee
Instruction ID: 38b881ff33a6243cc590fcd410e8e09e011c697c12e7ab142d2f1f59eaf5126d
Opcode Fuzzy Hash: ce60b4d0df5c0b0c6240fc9f83428cd15d69f2121c044c7f35762063f50825ee
Instruction Fuzzy Hash: 0211E9312502088FC7967738E55486D7BEBEEC23507244868D24BCFE54CE39698ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0278D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350164070.000000000278D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0278D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_278d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 9fdab25284a90a49e1afb5860e7081ce4b113ac264151f902df9be4ed2cf4178
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5B112672444240DFCB16DF10D5C4B16BF72FB84324F24C6A9DD090B256C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 062F8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40f16eee70579fa031612129e1cccd78ee9429d5c724c6bef5e5d5954cda2f1
Instruction ID: c5138327538877c46f6a810c0058e875d3fdc189f67f4011a2969fa0877ac41a
Opcode Fuzzy Hash: c40f16eee70579fa031612129e1cccd78ee9429d5c724c6bef5e5d5954cda2f1
Instruction Fuzzy Hash: 66017172B101199FDF10DAA9AC44ABFFBBAFB84651B148036EA14D3240DB349D1997A1

Uniqueness

Uniqueness Score: -1.00%

Function 062FC499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b185da479ad6e1966184dc0743b541d1ba8025a5916a2070adb267b5275b06c
Instruction ID: df705ab9d41372edc70278a78b72cac46eb6079cba21808dc706f74d981a24d2
Opcode Fuzzy Hash: 3b185da479ad6e1966184dc0743b541d1ba8025a5916a2070adb267b5275b06c
Instruction Fuzzy Hash: DE1104312082008FE325AF69E40862A7BE3EFC5315B208A39D14A8BA45DF749C0ECF91

Uniqueness

Uniqueness Score: -1.00%

Function 062FBC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41ac6738b8f18bbd69d83557b32b5ef7f234ea4760a045489a528e3f794e549
Instruction ID: d158c5e861a96f75479ce5d51ec282fcfe06984cd26501ef7015578c0c9f910d
Opcode Fuzzy Hash: b41ac6738b8f18bbd69d83557b32b5ef7f234ea4760a045489a528e3f794e549
Instruction Fuzzy Hash: 7501B5312402094F8689B738E55492D3ADBEEC12547644828D10B8FA14DD3ABC8BCB91

Uniqueness

Uniqueness Score: -1.00%

Function 0278DAC5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350164070.000000000278D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0278D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_278d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67df61b030e8553527eaf68753ccec28ece44c032cc6f84569b311bd16f10125
Instruction ID: 4a7f3063d071cb5f4ddda44d1748aae589d8a3166609c8c156d2866b7fb403cc
Opcode Fuzzy Hash: 67df61b030e8553527eaf68753ccec28ece44c032cc6f84569b311bd16f10125
Instruction Fuzzy Hash: FE01A2311483449EE730AA2AC984B67BFECEF45724F18C46AED091A2C6D3799841CA75

Uniqueness

Uniqueness Score: -1.00%

Function 062FE8B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302e90fbd7a52e2993ff504f00a3ec652b0392dde22d7fdd368b75ce778cb4cc
Instruction ID: 3479ef40ee12595aa5e857508db0cc8c78932581faf8a33f91872c05f269cfe1
Opcode Fuzzy Hash: 302e90fbd7a52e2993ff504f00a3ec652b0392dde22d7fdd368b75ce778cb4cc
Instruction Fuzzy Hash: FF012634618308DFCB06AF78D8148697FBAEF8620071084F9E940CB272DA32DC11D780

Uniqueness

Uniqueness Score: -1.00%

Function 062FC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db00af32c5e8c68c23667f061006b57cdaa4b928bfe76d754aa03643327d019a
Instruction ID: d604d7b67b0821d0c6bfad4caa487cf7ee0275c6996ed2bdbe91ce95df527e48
Opcode Fuzzy Hash: db00af32c5e8c68c23667f061006b57cdaa4b928bfe76d754aa03643327d019a
Instruction Fuzzy Hash: 2201B1302442048FE329BF69E40866A7BE7EFC4715F108A38D14B8BB44DF74AC0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 062F5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24523de34358b41ea5a9b5092f4afd175b54045fe6bb7b620efd20efdfd0faa2
Instruction ID: e172767a6ae4249752fc2332c6af97206e6d91e2b9fe660e06a3d9191504c3a1
Opcode Fuzzy Hash: 24523de34358b41ea5a9b5092f4afd175b54045fe6bb7b620efd20efdfd0faa2
Instruction Fuzzy Hash: 2E01F430A31702CFDBA88B39E504523F7F7BF94205B04883CEA0392654DBB5E880CB80

Uniqueness

Uniqueness Score: -1.00%

Function 062F6E90 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e53058a2b1432b40cef1e987cadb0c5a9541299a25df0828f923361fe85880e
Instruction ID: 9547588e6bf309586676cc957905d9c524c237c04ee3395373c29041e655ea3e
Opcode Fuzzy Hash: 9e53058a2b1432b40cef1e987cadb0c5a9541299a25df0828f923361fe85880e
Instruction Fuzzy Hash: A4F096632081D93EDB525EAA5C11DFB7FEDDB8D161B084056FEA8C1141C428C951A770

Uniqueness

Uniqueness Score: -1.00%

Function 062F8F43 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6647b6586f3d7e766138d1d33d344275673794977897ac5d814538b9091b8a1
Instruction ID: 2c1de0d0b954ebdd5ab8563d9781a62d1373eedbcfd7703e4225bbd4664d4a61
Opcode Fuzzy Hash: e6647b6586f3d7e766138d1d33d344275673794977897ac5d814538b9091b8a1
Instruction Fuzzy Hash: EE0104B4D6421AEFDB40DFA4E9447AEFBB0FB48301F5081A9E915A3340E7780A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 062F8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1ea68f395c6029bd5f5b7824d4ce3ad6e8ba5142cbca5f6ed3c7209727b3d8
Instruction ID: 76d9dafdb1dd1c94a70e4ad8db308969b273452b3f65f85b3e93d175b6baa941
Opcode Fuzzy Hash: 2f1ea68f395c6029bd5f5b7824d4ce3ad6e8ba5142cbca5f6ed3c7209727b3d8
Instruction Fuzzy Hash: A501C0B4D2420AEFDB84DFA9D9446AEFBF1FB48301F5085AA9915A3350E7780A41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0278DAC4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350164070.000000000278D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0278D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_278d000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf1e29911cb5e669e5be037432768366cb8d13cc9e1c4d394d9147e6d9de162
Instruction ID: 3f09aacc04847b5d3e7957e61ec0d0a874537625108aacb5c1f3260fbce44dcf
Opcode Fuzzy Hash: faf1e29911cb5e669e5be037432768366cb8d13cc9e1c4d394d9147e6d9de162
Instruction Fuzzy Hash: 99F06272404384AEE7249E16D8C4B66FFE8EF45624F18C55AED484A286D3799844CA71

Uniqueness

Uniqueness Score: -1.00%

Function 062FC170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c7203555584d5d60d31550b5bc35524df078b1185eddf1da070abf6545ef42
Instruction ID: 436cab7bf1d9889cbd56340ad602dc7671198c39b60603e5f1105d15455f0ae5
Opcode Fuzzy Hash: f8c7203555584d5d60d31550b5bc35524df078b1185eddf1da070abf6545ef42
Instruction Fuzzy Hash: 2B01D135509B049FD722EF25E448452BBF6FF49340710CA6EE58A86A10DB30A54ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 062F6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548d5ddd15fd21609394ac15166f64f09a80cb3b99559456175271dcebda388a
Instruction ID: 9ea560c10c03744f38846f8248f451e73a5dfcc7b4452ac5571f7e10a2aab61a
Opcode Fuzzy Hash: 548d5ddd15fd21609394ac15166f64f09a80cb3b99559456175271dcebda388a
Instruction Fuzzy Hash: 8BF0A7722041E83F8B115E9A5C10CFB7FEDDA8E1617084056FEE8D2141C43DCD21ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 062FACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a695cec0535540b478f15b625cfe595c66ef37558a4942f0b116bb54d29ca2bd
Instruction ID: 0ad7fc7d23dd4e6f622559599256b7e05c537927131b87edc69ad1dc2ecdb7ea
Opcode Fuzzy Hash: a695cec0535540b478f15b625cfe595c66ef37558a4942f0b116bb54d29ca2bd
Instruction Fuzzy Hash: 3FF09E717183558FC72717786C5447D7F6AEDC669130440EAF68BCB291CA144903C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 062F67C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5b80a7e028375103f059d6e88145a6db944363c6f2bec0ef033e6a51294147
Instruction ID: aee7205274d7211ee8f274e5bdda4b15e9254b3bd1e9c52aec68ce7c6695622c
Opcode Fuzzy Hash: 5e5b80a7e028375103f059d6e88145a6db944363c6f2bec0ef033e6a51294147
Instruction Fuzzy Hash: 47F09031B683006FD7208B68E851F957FE9DB82761F14817AF614CB1E2D6A1E849D740

Uniqueness

Uniqueness Score: -1.00%

Function 062FC110 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2c6586d35ae237408981da01d681352322d8090913b04b2b48d30354098f65
Instruction ID: 4e253db39a8bdc6916fa93dfae8c74974a2cfd26f092dc5613bfb97da7432745
Opcode Fuzzy Hash: eb2c6586d35ae237408981da01d681352322d8090913b04b2b48d30354098f65
Instruction Fuzzy Hash: D6F096302497D45FC312A738F91879B7FEADF82214B0404AEE286CB652CA656905C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 062FADE9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bb1b1e5770a5c3af8e8c10a44192e7c404b583ecc545d1a2a6915fcb8ee8f5
Instruction ID: 422124e00bddbd4b133bee086cc0f181c896166ec2d49a7d93233c1531b8b209
Opcode Fuzzy Hash: f5bb1b1e5770a5c3af8e8c10a44192e7c404b583ecc545d1a2a6915fcb8ee8f5
Instruction Fuzzy Hash: 68F02731204101ABC3202B6EF858A9FBFDBEFCA761F004138F11EC3242CE66284597A5

Uniqueness

Uniqueness Score: -1.00%

Function 062F8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decff067c259495d90ceeda23ce00a97bdf3dce202b8cd1f6be53b9dc1b3dec0
Instruction ID: 638908444936d2c00a6fdf17a9b58ecfb254c1d2d0006012d6946b4f0e19d5ac
Opcode Fuzzy Hash: decff067c259495d90ceeda23ce00a97bdf3dce202b8cd1f6be53b9dc1b3dec0
Instruction Fuzzy Hash: 87F0AFB4C281499FDB40CFA4D4045ADFFB0EB5A201F4042E6ED02E7261E6794A01DB40

Uniqueness

Uniqueness Score: -1.00%

Function 062F8341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1acf4bf5fc05bcc62a103325041eb4ed57eab8d824711b55a399e143b8edb588
Instruction ID: f448119ab17a068ff72fb0ea98f9cb4056b4f190f23bf9db90cea64d48649bb6
Opcode Fuzzy Hash: 1acf4bf5fc05bcc62a103325041eb4ed57eab8d824711b55a399e143b8edb588
Instruction Fuzzy Hash: C8F0A732F2411A5B8B109A69AC449BFBFB9EB95151B080037E914C3141FB34891997A1

Uniqueness

Uniqueness Score: -1.00%

Function 062F54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c93ea4406227834d86bcc40e2dcb070f27f2f7f86eef4dbdf3c0d1b06ca3464
Instruction ID: c810fc3657f97c856eaa54b84084119e611a7a917288b73075207ac8ed2a2c24
Opcode Fuzzy Hash: 0c93ea4406227834d86bcc40e2dcb070f27f2f7f86eef4dbdf3c0d1b06ca3464
Instruction Fuzzy Hash: 0BF0B4355307428FDBA5CF21D9007A7BBF2BF80319F08897DD88656A65D7B9E489CB40

Uniqueness

Uniqueness Score: -1.00%

Function 062FADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ac4511194aed56425933443f64191bc6dccc58741f94044be7f40009b0474d
Instruction ID: b849e014462d4c7c7d8ccc9d524989db0445306b7f74a13f29daea04ec888ddc
Opcode Fuzzy Hash: 73ac4511194aed56425933443f64191bc6dccc58741f94044be7f40009b0474d
Instruction Fuzzy Hash: 9DE092312002006BC3142A6AF888A9E7ADFEBCA761B40403CF20ED3241CE69680597B5

Uniqueness

Uniqueness Score: -1.00%

Function 062FC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0aba2ba29df8240cba5c2a2d4ee6791e4f2d6a4c1b1f6c6147982f49e8ee9b
Instruction ID: b83f42d5de74e35f06e334fb56055d83e6bf3e3728ef22c9814caef9e1bf7d57
Opcode Fuzzy Hash: 8c0aba2ba29df8240cba5c2a2d4ee6791e4f2d6a4c1b1f6c6147982f49e8ee9b
Instruction Fuzzy Hash: 97F09A74504B018FD725EF26E448552BBF7FB88304710C62EEA8B82A10DB70A54ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 062FB500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80bd0ba4d64a71e8162d650b151a24fe47fed68b1e558d2dbd6ddac8aa156d8a
Instruction ID: b2c4fb7bc7ec9a5708abfff2dc9283ca47a84df5f247e72f44d792cc56d2d868
Opcode Fuzzy Hash: 80bd0ba4d64a71e8162d650b151a24fe47fed68b1e558d2dbd6ddac8aa156d8a
Instruction Fuzzy Hash: F0F01535D0520CBFCB01DFB4D9498DEBBB9EB44240F1082AAA905E7240EA315B45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 062FC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73de430a07b2325468c5e29f1f928445bc9de0f061a32a1124614a247e062ec8
Instruction ID: ef9ef02dde484a772050d7e1b10e45af43c49966e5a61d5923dbe975dd4e8060
Opcode Fuzzy Hash: 73de430a07b2325468c5e29f1f928445bc9de0f061a32a1124614a247e062ec8
Instruction Fuzzy Hash: E4E0A0302047505FC211A72DF51879E7BEBDF81314F040429E2468BA00CBA5A806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062FCC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6055f8ae9204c18fe3503291836f8ab97e8a4358129e520b70800b4c4dd4deb6
Instruction ID: 831957f11bdb5e704ea767ab55f864c36840eaf368f62a146f037961476da5a4
Opcode Fuzzy Hash: 6055f8ae9204c18fe3503291836f8ab97e8a4358129e520b70800b4c4dd4deb6
Instruction Fuzzy Hash: A4E0D8322092448FC712FF15F8505897BB1EF81760B204276C186CF665D730480ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 062FCE88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e7dafed4233d2bf168335fd3483ebcc007c1049e362795488cf1338f6eff12
Instruction ID: 60c56e2e5bc12cce69bcc19f5ecbefe8e1f66850c780c0d1c393ccf697866bb8
Opcode Fuzzy Hash: 30e7dafed4233d2bf168335fd3483ebcc007c1049e362795488cf1338f6eff12
Instruction Fuzzy Hash: 77E0D87415D341EFE703F724F4455593FB5DF0172072001A9D8468F959EA34CC45C791

Uniqueness

Uniqueness Score: -1.00%

Function 062F5698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863d8aefedaad1e3119ab99b02dd88d0bc9ebf7b36ddda6004edae596f430221
Instruction ID: 8adf1b047e521bd95037a39205597a08e9e26013428c68cb1d03cae59d12d37c
Opcode Fuzzy Hash: 863d8aefedaad1e3119ab99b02dd88d0bc9ebf7b36ddda6004edae596f430221
Instruction Fuzzy Hash: 34E092B210D3119FE304DB20E840896BBE4EF91320B05886EF480D7281E731E841C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 062FE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09afbdc7d09f38ec4472e2d3fe0cea86f04d4afad0a6077015897e3a771b160e
Instruction ID: 40de9073c87db5574adb8fc088503aef2f279e148e6cf148080484a733955fb0
Opcode Fuzzy Hash: 09afbdc7d09f38ec4472e2d3fe0cea86f04d4afad0a6077015897e3a771b160e
Instruction Fuzzy Hash: 6BE0DF71A49208EFCB01DF68E8009AE3BB6DB8221073043DAD80AEB6A0E6304F15D751

Uniqueness

Uniqueness Score: -1.00%

Function 062FAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89ceec3658f166210283173a135496e430b9174031bf792203c7dc38a966408
Instruction ID: 72dd2c52cb6b0884d93e2a29efe98969ec06d66bb27569829fce3e090b415426
Opcode Fuzzy Hash: c89ceec3658f166210283173a135496e430b9174031bf792203c7dc38a966408
Instruction Fuzzy Hash: AFD05B3130021557CA09376DF4584AE77AFDBC56613004039F70BD3240DE755D0687D6

Uniqueness

Uniqueness Score: -1.00%

Function 062FE8F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0d2adfc705bc73f868fb66a98077656a04208e943cf25e644d5ca7777cb62e
Instruction ID: 4b1cccab4600fa3cbbfc5aee51fbf17933efcc513a525405b769a89f119da720
Opcode Fuzzy Hash: aa0d2adfc705bc73f868fb66a98077656a04208e943cf25e644d5ca7777cb62e
Instruction Fuzzy Hash: 55E0123A164248DFC7529F54D8508557FB5FF4965035550C5F6C48F272D731D821DB60

Uniqueness

Uniqueness Score: -1.00%

Function 062FB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2cb68e4b47d9b3bb227be6efd3d07db6438a8f9bdef61436e4c920955d4b87
Instruction ID: 3c004daa3a7647c641911670045b1ddc9fe9a46bc5626442079772b9cc487aa3
Opcode Fuzzy Hash: 3e2cb68e4b47d9b3bb227be6efd3d07db6438a8f9bdef61436e4c920955d4b87
Instruction Fuzzy Hash: DCE07575D0420CFFCB40DFA4D5448DDBBB9EB48240F1082A6D905A3200EA315B55DB80

Uniqueness

Uniqueness Score: -1.00%

Function 062FE280 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87556ce2da2e05425b7e5a229031f13d3b5e2d26a91d232ac5cc342c91bd0852
Instruction ID: c1b77f2f9e60f292cfe24b8baaf492e95c2e4cd3c74c4f2b46187c171fd1b3de
Opcode Fuzzy Hash: 87556ce2da2e05425b7e5a229031f13d3b5e2d26a91d232ac5cc342c91bd0852
Instruction Fuzzy Hash: B7E026311041028FE70CFB14FD9AA44B3A6E748B04F100218C8070FA68E7705A29CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 062FE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9f9d85d5892a29e25cd7a58932bab2536f98f301bbb7ae0fd6f601b51ca040
Instruction ID: 638477acdc15bb4d1a9e087364f5d7547c7e28ddabf633ac2254f47686ec4062
Opcode Fuzzy Hash: 9d9f9d85d5892a29e25cd7a58932bab2536f98f301bbb7ae0fd6f601b51ca040
Instruction Fuzzy Hash: 6CD01771A0420CFF8B40EFA8E90195DBBBAEB44214B2041A9D50AEB600EA316F009B90

Uniqueness

Uniqueness Score: -1.00%

Function 062FF8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25952c85d2ce43360393e450955a83046773626f6ebcd00415d01c50d7b0d28
Instruction ID: 0e379c4eb3c5066abf7f73e2635b6a8da90e353c63ebd7fa9086cff836e03156
Opcode Fuzzy Hash: d25952c85d2ce43360393e450955a83046773626f6ebcd00415d01c50d7b0d28
Instruction Fuzzy Hash: EDC012B2B481200B4284B66CB01406E66D782C86A33A7406BE60EC7388CD708C428794

Uniqueness

Uniqueness Score: -1.00%

Function 062FDFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7be34b6c0244eced063ced219034cbcccc3d6c6ccc9ec041bc03db3875d20f
Instruction ID: 2bdb6014766b7c8d8e817dee05e518f1f188d68665668ef5a9c265d4980eb44d
Opcode Fuzzy Hash: 4f7be34b6c0244eced063ced219034cbcccc3d6c6ccc9ec041bc03db3875d20f
Instruction Fuzzy Hash: B7C08C3418F3D02EDB0203348C0D4853E219B8221031100DAA200CF0A2DA110001C791

Uniqueness

Uniqueness Score: -1.00%

Function 062F3721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce9e25ea69cb5769fd58a194a024bdd8274d1549dfc40996af59a3505741366
Instruction ID: a30c3e22b4b386a2463da85451018ada71d35786444a62ab68435547895745da
Opcode Fuzzy Hash: dce9e25ea69cb5769fd58a194a024bdd8274d1549dfc40996af59a3505741366
Instruction Fuzzy Hash: 33C09272A5A2415BE700DBA0BC1AFA13E60AB94B02F065111E78286093C7A9519ACBA6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 079F21D8 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

Haq, xrefs: 079F22D8

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 45aa843cf3240a3e926ac7c8126ccbf8375da2feebe236c53b59e1e9dbb2dcfb
Instruction ID: 4f6c64634d8f8597be97579d9d26656d2581d8109e6bfb592d3e0e9932ec4fc5
Opcode Fuzzy Hash: 45aa843cf3240a3e926ac7c8126ccbf8375da2feebe236c53b59e1e9dbb2dcfb
Instruction Fuzzy Hash: DFE1E0B4E002298FDB14CFA9C884BEEBBB2FF89314F1481A9D518B7255D7749A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F21C8 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

Haq, xrefs: 079F22D8

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 20bb29ab84f50af3959f234b2250a9c70f107036d1c634fe3dde408e65823e14
Instruction ID: 3d609fca27be3db4aed8d9e31146deff6fb0a4b4893531ae18ca84c3fcd51cf8
Opcode Fuzzy Hash: 20bb29ab84f50af3959f234b2250a9c70f107036d1c634fe3dde408e65823e14
Instruction Fuzzy Hash: 4B611AB1D002298FDB14CFAAC884BEEFBF6BF88314F0485A9D518A7251D7745A86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F2AF0 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a975e4c2597e5d535ede98c066e147478b1191ce80899e05f8220900cd7e358e
Instruction ID: d9adf49b9a01003aba601f80c40e1d9fa0467e75761d61574e02986e6b80a733
Opcode Fuzzy Hash: a975e4c2597e5d535ede98c066e147478b1191ce80899e05f8220900cd7e358e
Instruction Fuzzy Hash: C2920DB4A101168FC754DF68C991BAEB7B2FF88304F55C6A9D609AB346C734E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 062F6FE8 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c510b7efa41c7f00d2e721a336c58491d7ccfa8cf8e2ccd6b3ea18fdedc9ccb
Instruction ID: be56fef0f19d2934a2ad5c43997a17f29ba22d76459e64106858cee7e0a64527
Opcode Fuzzy Hash: 7c510b7efa41c7f00d2e721a336c58491d7ccfa8cf8e2ccd6b3ea18fdedc9ccb
Instruction Fuzzy Hash: FB624FB06402009FD749EF19D45871A7AEAEF84308F64C89CC10D9F296DFBAD90BCB95

Uniqueness

Uniqueness Score: -1.00%

Function 062F6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47027ab00a16dbff0f23774a9e2dc7f98eb0d3ebd666849ceeb3c8c0186e32b4
Instruction ID: 011371b30e7c21860908c60a28da5fd6a849bacf66b59ac67f944657e374185c
Opcode Fuzzy Hash: 47027ab00a16dbff0f23774a9e2dc7f98eb0d3ebd666849ceeb3c8c0186e32b4
Instruction Fuzzy Hash: 56623FB06402009FD749EF19D45871A7AEAEF84308F64C99CC10D9F396DFBAD90B8B95

Uniqueness

Uniqueness Score: -1.00%

Function 079F2AE0 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e4b8ec22d9ba557d73ba6a0c733e12cb03ad6a821e287f2619e4dea4142a6b
Instruction ID: b8616c97908e5816ef015606eb0c0040bdca51acbfd149bd83ef6e529502ecca
Opcode Fuzzy Hash: 32e4b8ec22d9ba557d73ba6a0c733e12cb03ad6a821e287f2619e4dea4142a6b
Instruction Fuzzy Hash: 77320DB4A001259FD754DF68C990BADBBB2FF88304F55C6A9D509AB346C734E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93da33d5d8ccdf9cbd196ec9e39c1e4b69ed9816eba519e07dc8c78b65288cb1
Instruction ID: eb345b6fb284dbc69a3f4596d8faa56a53ac2fbad601b481fbb77c85ffb461b0
Opcode Fuzzy Hash: 93da33d5d8ccdf9cbd196ec9e39c1e4b69ed9816eba519e07dc8c78b65288cb1
Instruction Fuzzy Hash: 531296B8C817458AEB10CF25F94C1893BB1B751718BF04A29D2613B6E5DBBC35AACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0289DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8f0cecf29579dc3d7d70be4e8b60f24e85104bda1e5d6ed4597058cbcdf866
Instruction ID: fc3fd57b7c64c441648f14a28dc1a52d133b1af31dcb42e9af8504926f4873c6
Opcode Fuzzy Hash: bf8f0cecf29579dc3d7d70be4e8b60f24e85104bda1e5d6ed4597058cbcdf866
Instruction Fuzzy Hash: FCA17E3AE002198FCF09DFB8C94059EB7B2FF85304B19856AE905EB265DB75E915CF80

Uniqueness

Uniqueness Score: -1.00%

Function 079F93C8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f715ddb5a1194e8fcca1d7d959b333d32834f1802ab53859c8c2d9c0b9054176
Instruction ID: ff9c56bf74412b019dd1fe17501882f87f141e57e7e621441a6f2172b2562da4
Opcode Fuzzy Hash: f715ddb5a1194e8fcca1d7d959b333d32834f1802ab53859c8c2d9c0b9054176
Instruction Fuzzy Hash: E3C19F74E01218CFDB54DFA9D890B9DBBB2FF89304F1085A9D409AB354DB349986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 079F93D8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c0b31a7d573a589103e5bc1a43d44a5776971ed7ae1ab89d470d32fe4068dd
Instruction ID: 3036322bfc5c8878772bdc647a435ef4122660dcf157a3e311a1048c9e8d8e52
Opcode Fuzzy Hash: a5c0b31a7d573a589103e5bc1a43d44a5776971ed7ae1ab89d470d32fe4068dd
Instruction Fuzzy Hash: F8C17E74E01218CFDB55DFA9D890B9DBBB2FF89300F2085AAD409AB355DB349986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 079F4FB8 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8b011972962e005884b44c00f5c54ac837903ed59b63d7b5b29ebb1828ec0d
Instruction ID: fedcb97022c02dc6467fd033442329972a68cb12da2677bae5be77197c306fc5
Opcode Fuzzy Hash: 2c8b011972962e005884b44c00f5c54ac837903ed59b63d7b5b29ebb1828ec0d
Instruction Fuzzy Hash: 59B1E674A01209DFDB10CFA8C584A8EFBF5FF49319F5AC1A5E514AB216D730E985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04FA001C Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2371538854.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fa0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b816d26cabaa90ade94ca3c2d6a28addaa8e3cc8820defb526b4c8d78724d54
Instruction ID: 8fefa92ce6dea329abdedac9b6d44b61812aaf79be6834208328a6eeb6389418
Opcode Fuzzy Hash: 5b816d26cabaa90ade94ca3c2d6a28addaa8e3cc8820defb526b4c8d78724d54
Instruction Fuzzy Hash: 01C1F9B8C807458BEB10CF25E8481897BB1FB95314FB04A29D2617B2D5DBBC35AACF44

Uniqueness

Uniqueness Score: -1.00%

Function 028925D8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350521079.0000000002890000.00000040.00000800.00020000.00000000.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa030e4f065f082ee448d39e9d31b89799dddc3919a6871cbceede8168cf24e
Instruction ID: 1612d40ca0092452f70757039196d8837dc80668f3c50112f1fbc9dab66da287
Opcode Fuzzy Hash: 9fa030e4f065f082ee448d39e9d31b89799dddc3919a6871cbceede8168cf24e
Instruction Fuzzy Hash: 8731611A899BF06FCB139A7A58700C13F60DC5722D70953C7C5A4CA6FFE549458BC3A6

Uniqueness

Uniqueness Score: -1.00%

Function 079F6050 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f844fb02a64601d6b1a95cf797f3f293e01b14bb6e8ecdc789451dcc82799fd0
Instruction ID: f2997bb129974ef01d5c7bc94c43380859dcb0fd4172042474665d40c7c37d6b
Opcode Fuzzy Hash: f844fb02a64601d6b1a95cf797f3f293e01b14bb6e8ecdc789451dcc82799fd0
Instruction Fuzzy Hash: C441E9B1E002188FDB18DFAAD8507DEBBF2BF89304F14C1AAC509A7251DB345985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 079F5878 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e945c4b48b757076dc7eafa83e7206f30b8bd4978f3f376a01ee8e1b682e6b6
Instruction ID: 18c0ddc5841c5576b4ef9101736d9ffdd2c7cf582039d381265307841bbee8bd
Opcode Fuzzy Hash: 9e945c4b48b757076dc7eafa83e7206f30b8bd4978f3f376a01ee8e1b682e6b6
Instruction Fuzzy Hash: 5441E7B1E002298FDB18DFAAD8447DEBBF2BF88314F14C16AC519AB294DB344946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079F6B28 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375981114.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2905d4d9bad9f838e118234dbd5a44bcd108fac1fa13f0536a23c1f999e586cc
Instruction ID: 66b3fc4ce17e58a93c13bbd2cc7e0ecbc0474bdd68432db58d5ab6b41a0db270
Opcode Fuzzy Hash: 2905d4d9bad9f838e118234dbd5a44bcd108fac1fa13f0536a23c1f999e586cc
Instruction Fuzzy Hash: 6F31D1B1E003188BDB18DFAAD8446DEFBF6AF88314F14C13AC409AB265EB345946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 062FE2C7 Relevance: 46.6, Strings: 37, Instructions: 387COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FE3C2
Dsj, xrefs: 062FE4A3
Dsj, xrefs: 062FE7EE
Dsj, xrefs: 062FE593
Dsj, xrefs: 062FE309
Dsj, xrefs: 062FE3E7
Dsj, xrefs: 062FE5E3
Dsj, xrefs: 062FE5BB
Dsj, xrefs: 062FE4F3
Dsj, xrefs: 062FE47B
Dsj, xrefs: 062FE543
Dsj, xrefs: 062FE39D
Dsj, xrefs: 062FE456
Dsj, xrefs: 062FE2E4
Dsj, xrefs: 062FE6A8
Dsj, xrefs: 062FE51B
Dsj, xrefs: 062FE378
Dsj, xrefs: 062FE658
Dsj, xrefs: 062FE6F8
Dsj, xrefs: 062FE32E
Dsj, xrefs: 062FE6D0
Dsj, xrefs: 062FE431
Dsj, xrefs: 062FE630
Dsj, xrefs: 062FE40C
Dsj, xrefs: 062FE7C3
Dsj, xrefs: 062FE4CB
Dsj, xrefs: 062FE844
Dsj, xrefs: 062FE819
Dsj, xrefs: 062FE56B
Dsj, xrefs: 062FE748
Dsj, xrefs: 062FE353
Dsj, xrefs: 062FE770
Dsj, xrefs: 062FE720
Dsj, xrefs: 062FE680
Dsj, xrefs: 062FE86F
Dsj, xrefs: 062FE798
Dsj, xrefs: 062FE608

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3332464785
Opcode ID: 869746a2becfb8d91e6a221e5935053aa027d2734059e6e871ee3e8e80d0a6b8
Instruction ID: 867798b237b4f1212c15368f59647e4f4e950e02640b87c0bf9a36dd52b9a327
Opcode Fuzzy Hash: 869746a2becfb8d91e6a221e5935053aa027d2734059e6e871ee3e8e80d0a6b8
Instruction Fuzzy Hash: EDD1D1303406156BC20B76A4EE55ABDA697FF87704B904838D1084F7A9DF79AC1F9B82

Uniqueness

Uniqueness Score: -1.00%

Function 062FE2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FE3C2
Dsj, xrefs: 062FE4A3
Dsj, xrefs: 062FE7EE
Dsj, xrefs: 062FE593
Dsj, xrefs: 062FE309
Dsj, xrefs: 062FE3E7
Dsj, xrefs: 062FE5E3
Dsj, xrefs: 062FE5BB
Dsj, xrefs: 062FE4F3
Dsj, xrefs: 062FE47B
Dsj, xrefs: 062FE543
Dsj, xrefs: 062FE39D
Dsj, xrefs: 062FE456
Dsj, xrefs: 062FE2E4
Dsj, xrefs: 062FE6A8
Dsj, xrefs: 062FE51B
Dsj, xrefs: 062FE378
Dsj, xrefs: 062FE658
Dsj, xrefs: 062FE6F8
Dsj, xrefs: 062FE32E
Dsj, xrefs: 062FE6D0
Dsj, xrefs: 062FE431
Dsj, xrefs: 062FE630
Dsj, xrefs: 062FE40C
Dsj, xrefs: 062FE7C3
Dsj, xrefs: 062FE4CB
Dsj, xrefs: 062FE844
Dsj, xrefs: 062FE819
Dsj, xrefs: 062FE56B
Dsj, xrefs: 062FE748
Dsj, xrefs: 062FE353
Dsj, xrefs: 062FE770
Dsj, xrefs: 062FE720
Dsj, xrefs: 062FE680
Dsj, xrefs: 062FE86F
Dsj, xrefs: 062FE798
Dsj, xrefs: 062FE608

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3332464785
Opcode ID: 52453e8d5d1c2ca01f06cd98f1f6ae22c7f140a13c657a54416f9397e5909174
Instruction ID: ec90f291a01b50249fb6998716c91e25f87671f7068580df126ebbcd749cc0eb
Opcode Fuzzy Hash: 52453e8d5d1c2ca01f06cd98f1f6ae22c7f140a13c657a54416f9397e5909174
Instruction Fuzzy Hash: 5DD1C0303406146BC20B76A4EE54ABDA697FF8B704B904838D1084F799DF79AC1F9B83

Uniqueness

Uniqueness Score: -1.00%

Function 062FCC7F Relevance: 16.4, Strings: 13, Instructions: 151COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FCD7A
Dsj, xrefs: 062FCCE6
Dsj, xrefs: 062FCE0E
Dsj, xrefs: 062FCD30
Dsj, xrefs: 062FCCC1
Dsj, xrefs: 062FCE33
Dsj, xrefs: 062FCDC4
Dsj, xrefs: 062FCD9F
Dsj, xrefs: 062FCC9C
Dsj, xrefs: 062FCDE9
Dsj, xrefs: 062FCE58
Dsj, xrefs: 062FCD55
Dsj, xrefs: 062FCD0B

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-2675541404
Opcode ID: 87a30283f5f50f959bde0c38d9f8dfcce5848f7654fdb804578a7d989613b849
Instruction ID: 01d8b6cdf22c81ec4f429185b6a2589d339a7bb1c11f0df0dcb6e47d292a751f
Opcode Fuzzy Hash: 87a30283f5f50f959bde0c38d9f8dfcce5848f7654fdb804578a7d989613b849
Instruction Fuzzy Hash: 8D41A4303406156BD20677A4EE45AAE6697FB87700B504838D2084F79ADF79AD0F8B97

Uniqueness

Uniqueness Score: -1.00%

Function 062FCC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FCD7A
Dsj, xrefs: 062FCCE6
Dsj, xrefs: 062FCE0E
Dsj, xrefs: 062FCD30
Dsj, xrefs: 062FCCC1
Dsj, xrefs: 062FCE33
Dsj, xrefs: 062FCDC4
Dsj, xrefs: 062FCD9F
Dsj, xrefs: 062FCC9C
Dsj, xrefs: 062FCDE9
Dsj, xrefs: 062FCE58
Dsj, xrefs: 062FCD55
Dsj, xrefs: 062FCD0B

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-2675541404
Opcode ID: e72e289499e8c2f75dabaac62d38020ca0830c4a31683253e9688017357d0fe4
Instruction ID: 8250e0f6140405d5730580aa7f5eaef8db59e74418139e2919ca146d65219468
Opcode Fuzzy Hash: e72e289499e8c2f75dabaac62d38020ca0830c4a31683253e9688017357d0fe4
Instruction Fuzzy Hash: BF41B5303406152BD20676A4EE45ABE669BFB8B700F504838D2084F799CF79AD0F8B96

Uniqueness

Uniqueness Score: -1.00%

Function 062FCED1 Relevance: 10.1, Strings: 8, Instructions: 104COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FCFEF
Dsj, xrefs: 062FCF36
Dsj, xrefs: 062FCFA5
Dsj, xrefs: 062FCF80
Dsj, xrefs: 062FCF11
Dsj, xrefs: 062FCFCA
Dsj, xrefs: 062FCF5B
Dsj, xrefs: 062FCEEC

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-975092858
Opcode ID: 4446d512f7b88c05a3febc11633194350b6853661e8a673a04833b9c8564c7ff
Instruction ID: eb621a7e0d2a1c0c1bea0781fe76db1a6f1a56db98e2ccac4fb2f1d05b1bd511
Opcode Fuzzy Hash: 4446d512f7b88c05a3febc11633194350b6853661e8a673a04833b9c8564c7ff
Instruction Fuzzy Hash: 5631E6303402116FC7077AA4E944ABDB69BFB87710B504838D1088F79ADF79AD0F8B96

Uniqueness

Uniqueness Score: -1.00%

Function 062FCEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FCFEF
Dsj, xrefs: 062FCF36
Dsj, xrefs: 062FCFA5
Dsj, xrefs: 062FCF80
Dsj, xrefs: 062FCF11
Dsj, xrefs: 062FCFCA
Dsj, xrefs: 062FCF5B
Dsj, xrefs: 062FCEEC

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-975092858
Opcode ID: 34e19f8609688273f1d866152230a67d04aa126b50a929f2e4617080a89eea10
Instruction ID: 8021c150cbbef9be4cfb1f1348f73f816bd99907fa501e4667e047ae0bce7c90
Opcode Fuzzy Hash: 34e19f8609688273f1d866152230a67d04aa126b50a929f2e4617080a89eea10
Instruction Fuzzy Hash: 2021D7307402152BC70676A4E944ABDA69BFB87714F904838D20C4F799DF79AC0F8B96

Uniqueness

Uniqueness Score: -1.00%

Function 062FC968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FCA7A
Dsj, xrefs: 062FC9AD
Dsj, xrefs: 062FC984
Dsj, xrefs: 062FCA51
Dsj, xrefs: 062FC9D6
Dsj, xrefs: 062FC9FF
Dsj, xrefs: 062FCA28

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3690536320
Opcode ID: 52234d6d713fef057169d39decbd9c1aebb75be4d5ecd5b9011fa5ac7b68832b
Instruction ID: d4269d7d37296601a66a4abe4cb631d08322d1a4a229f3f096f4c71a53a4a825
Opcode Fuzzy Hash: 52234d6d713fef057169d39decbd9c1aebb75be4d5ecd5b9011fa5ac7b68832b
Instruction Fuzzy Hash: 8431F131340256AFCB062BA4EC549AD7BA7FF867047104478E1098FAA9CE785D4FCBC2

Uniqueness

Uniqueness Score: -1.00%

Function 062FC978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FCA7A
Dsj, xrefs: 062FC9AD
Dsj, xrefs: 062FC984
Dsj, xrefs: 062FCA51
Dsj, xrefs: 062FC9D6
Dsj, xrefs: 062FC9FF
Dsj, xrefs: 062FCA28

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-3690536320
Opcode ID: cf4d81c95988cb2797711aac973075bce65bbf635076c9e8b698232ad4ba95c1
Instruction ID: bc926aa5d1bebcd44648ad93d7b7ab0c9d97884e757fbee1fb84cacdf7c1a994
Opcode Fuzzy Hash: cf4d81c95988cb2797711aac973075bce65bbf635076c9e8b698232ad4ba95c1
Instruction Fuzzy Hash: 2221A031740116ABCB063BA5E9548AE77A7FF867047104038E1098FBA9CE785D4F8FC2

Uniqueness

Uniqueness Score: -1.00%

Function 062FD538 Relevance: 7.6, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FD5E8
Dsj, xrefs: 062FD5C3
Dsj, xrefs: 062FD59E
Dsj, xrefs: 062FD554
Dsj, xrefs: 062FD60D
Dsj, xrefs: 062FD579

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-118940947
Opcode ID: f6aecb45beca92a2ff8e34bf460ee3b65dd3f1b88b9a9d9d9c43bfed83137f6f
Instruction ID: ee46a38f7e4d0fb8eda93b8f2bec3ecdbca9e1e2237b452cdc7ae1887e3b1e18
Opcode Fuzzy Hash: f6aecb45beca92a2ff8e34bf460ee3b65dd3f1b88b9a9d9d9c43bfed83137f6f
Instruction Fuzzy Hash: 2221C7307402102BD30776A4E994AADB69BEB87714F504938D1088F796CF796D1E87A2

Uniqueness

Uniqueness Score: -1.00%

Function 062FD548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

Dsj, xrefs: 062FD5E8
Dsj, xrefs: 062FD5C3
Dsj, xrefs: 062FD59E
Dsj, xrefs: 062FD554
Dsj, xrefs: 062FD60D
Dsj, xrefs: 062FD579

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: Dsj$Dsj$Dsj$Dsj$Dsj$Dsj
API String ID: 0-118940947
Opcode ID: e6efcf10f345782233ebb0a694a3ccc58b1452a717ade03b856f6fce20555d51
Instruction ID: 718b063b40a3b416c236add06a847142669606dc31a535b0076b0b7a79847f78
Opcode Fuzzy Hash: e6efcf10f345782233ebb0a694a3ccc58b1452a717ade03b856f6fce20555d51
Instruction Fuzzy Hash: AD11EB307402142BC20677A5E984AADA69BFB87714F904938D1084F79ACF7AAD1F8793

Uniqueness

Uniqueness Score: -1.00%

Function 062FED10 Relevance: 5.2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

Strings

(_]q, xrefs: 062FEF79
(_]q, xrefs: 062FEDF9
(_]q, xrefs: 062FED7A
(_]q, xrefs: 062FEEFA

Memory Dump Source

Source File: 00000000.00000002.2372647743.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62f0000_ExAXLXWP9K.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q
API String ID: 0-2651352888
Opcode ID: 07880e1e590e22dbcbd7fc8f5a2dcfb33cedfb5038b310b7ea9127df2bcb43b3
Instruction ID: 0bf4fc4d98ec8260b2f2926d46f573374eadbbf86daa9c46fe92709f2844c3f8
Opcode Fuzzy Hash: 07880e1e590e22dbcbd7fc8f5a2dcfb33cedfb5038b310b7ea9127df2bcb43b3
Instruction Fuzzy Hash: 5E91CC34B18304AFCB09AF68C4545AEBBB2FF85310F2584AADD46DB391DA35DD06CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ExAXLXWP9K.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ExAXLXWP9K.exe.log

C:\Users\user\AppData\Local\Temp\Tmp9FF3.tmp

C:\Users\user\AppData\Local\Temp\TmpA004.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
ExAXLXWP9K.exe

Function 079F87C8 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Function 079F3998 Relevance: 2.8, Strings: 2, Instructions: 251
COMMON

Function 079F3989 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Function 079F7230 Relevance: 1.9, Strings: 1, Instructions: 644
COMMON

Function 062F3F50 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Function 062E0D80 Relevance: 20.6, Strings: 16, Instructions: 619
COMMON

Function 062E157B Relevance: 7.8, Strings: 6, Instructions: 338
COMMON