Edit tour

Windows Analysis Report
gm5v3JlTMk.exe

Overview

General Information

Sample name:	gm5v3JlTMk.exe renamed because original name is a hash value
Original sample name:	79fc20c78e45d10f5f6d3f12c736b8d5.exe
Analysis ID:	1431061
MD5:	79fc20c78e45d10f5f6d3f12c736b8d5
SHA1:	4a6b50e0cc1aa3c98bcb786311421ebf6815dcd0
SHA256:	5e0a9b8f7175b983c012fa530bb29693cd8aadf2b2feb0f56d1c089fac20edb4
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

gm5v3JlTMk.exe (PID: 6936 cmdline: "C:\Users\user\Desktop\gm5v3JlTMk.exe" MD5: 79FC20C78E45D10F5F6D3F12C736B8D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gm5v3JlTMk.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1641741658.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gm5v3JlTMk.exe PID: 6936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gm5v3JlTMk.exe PID: 6936	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.gm5v3JlTMk.exe.bc0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 103.113.70.99 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-14:27:04.417356
SID:	2046056
Source Port:	2630
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-14:26:58.880918
SID:	2046045
Source Port:	49730
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 103.113.70.99

Timestamp:	04/24/24-14:27:11.399846
SID:	2043231
Source Port:	49730
Destination Port:	2630
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 103.113.70.99 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-14:26:59.108894
SID:	2043234
Source Port:	2630
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: gm5v3JlTMk.exe

Malware Configuration Extractor: RedLine {"C2 url": ["103.113.70.99:2630"], "Bot Id": "spoo", "Authorization Header": "a442868c38da8722ebccd4819def00b2"}

Multi AV Scanner detection for submitted file

Source: gm5v3JlTMk.exe

Virustotal: Detection: 63%

Perma Link

Source: gm5v3JlTMk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: gm5v3JlTMk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 103.113.70.99:2630
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 103.113.70.99:2630 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 103.113.70.99:2630 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 103.113.70.99:2630

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 103.113.70.99:2630

Source: Joe Sandbox View

IP Address: 103.113.70.99 103.113.70.99

Source: Joe Sandbox View

ASN Name: NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN

Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.113.70.99

Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: gm5v3JlTMk.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp2B6A.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp2B59.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_0177DC74	0_2_0177DC74
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_068067D8	0_2_068067D8
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_0680A3E8	0_2_0680A3E8
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_06803F50	0_2_06803F50
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_0680A3D8	0_2_0680A3D8
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_06806FE8	0_2_06806FE8
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_06806FF8	0_2_06806FF8

Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $qq,\\StringFileInfo\\000004B0\\OriginalFilename vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $qq,\\StringFileInfo\\040904B0\\OriginalFilename vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $qq,\\StringFileInfo\\080904B0\\OriginalFilename vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1788689384.000000000132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000000.1641772098.0000000000C06000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUpspearing.exe8 vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs gm5v3JlTMk.exe
Source: gm5v3JlTMk.exe	Binary or memory string: OriginalFilenameUpspearing.exe8 vs gm5v3JlTMk.exe

Source: gm5v3JlTMk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp2B59.tmp

Jump to behavior

Source: gm5v3JlTMk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gm5v3JlTMk.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gm5v3JlTMk.exe

Virustotal: Detection: 63%

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: gm5v3JlTMk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gm5v3JlTMk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: gm5v3JlTMk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: gm5v3JlTMk.exe

Static PE information: 0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_0680C711 push es; ret	0_2_0680C720
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_0680D413 push es; ret	0_2_0680D420
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_0680ECF2 push eax; ret	0_2_0680ED01
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_06803B4F push dword ptr [esp+ecx*2-75h]; ret	0_2_06803B53
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Code function: 0_2_068049AB push FFFFFF8Bh; retf	0_2_068049AD

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Memory allocated: 1730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Window / User API: threadDelayed 1183			Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Window / User API: threadDelayed 8293			Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe TID: 5076	Thread sleep time: -29514790517935264s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe TID: 6980	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: gm5v3JlTMk.exe, 00000000.00000002.1806169995.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Users\user\Desktop\gm5v3JlTMk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: gm5v3JlTMk.exe, 00000000.00000002.1806339355.0000000006C1E000.00000004.00000020.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1813081446.0000000007BB9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: gm5v3JlTMk.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gm5v3JlTMk.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1641741658.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gm5v3JlTMk.exe PID: 6936, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $qq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRqq
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRqq
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $qq%appdata%`,qqdC:\Users\user\AppData\Roaming`,qqdC:\Users\user\AppData\Roaming\Binance
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $qq&%localappdata%\Coinomi\Coinomi\walletsLRqq
Source: gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $qq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\gm5v3JlTMk.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gm5v3JlTMk.exe PID: 6936, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: gm5v3JlTMk.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gm5v3JlTMk.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1641741658.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gm5v3JlTMk.exe PID: 6936, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gm5v3JlTMk.exe	63%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003459000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.000000000324C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	gm5v3JlTMk.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000033DB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	gm5v3JlTMk.exe, 00000000.00000002.1792581225.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	gm5v3JlTMk.exe, 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.113.70.99	unknown	India		133973	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431061
Start date and time:	2024-04-24 14:26:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gm5v3JlTMk.exe renamed because original name is a hash value
Original Sample Name:	79fc20c78e45d10f5f6d3f12c736b8d5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:27:04	API Interceptor	48x Sleep call for process: gm5v3JlTMk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.113.70.99	o8uKhd6peZ.exe	Get hash	malicious	RedLine	Browse
	vguZEL1YWf.exe	Get hash	malicious	RedLine	Browse
	djiwhBMknd.exe	Get hash	malicious	RedLine	Browse
	ExAXLXWP9K.exe	Get hash	malicious	RedLine	Browse
	44QHzbqD3m.exe	Get hash	malicious	RedLine	Browse
	3q1lESMAMh.exe	Get hash	malicious	RedLine	Browse
	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN	o8uKhd6peZ.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	vguZEL1YWf.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	djiwhBMknd.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	ExAXLXWP9K.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	44QHzbqD3m.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	3q1lESMAMh.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	fkmfYBX2c6.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	IcDaW5Yzvb.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99
	W8Q1QyZc1j.exe	Get hash	malicious	RedLine	Browse	103.113.70.99

Process:	C:\Users\user\Desktop\gm5v3JlTMk.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:30 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4534191264567817
Encrypted:	false
SSDEEP:	48:8SZdATkoGRYrnvPdAKRkdAGdAKRFdAKR/U:8SMt
MD5:	DA74D3CDB2BA438B2A4FD95D0DC10B64
SHA1:	DB43D3C6EB8534D2293B34543B9C16B4D95481DC
SHA-256:	5BD94DA2BD0C0C51246C9261ACA41A6318DC291687D0C007C6A0AF334458803F
SHA-512:	FF076DEC7AB06BC3A5F348E5C44E63509C674F9172E888668D13F32D7E80E384ED92D7EAC55E8A9AD0F7870621A753D589B7BF5648912D5D1F49E5ADAD66B8FB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....V........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWP`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWP`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWP`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gm5v3JlTMk.exe.log

Download File

Process:	C:\Users\user\Desktop\gm5v3JlTMk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp2B59.tmp

Download File

Process:	C:\Users\user\Desktop\gm5v3JlTMk.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp2B6A.tmp

Download File

Process:	C:\Users\user\Desktop\gm5v3JlTMk.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\gm5v3JlTMk.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.062568447042871
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	gm5v3JlTMk.exe
File size:	312'891 bytes
MD5:	79fc20c78e45d10f5f6d3f12c736b8d5
SHA1:	4a6b50e0cc1aa3c98bcb786311421ebf6815dcd0
SHA256:	5e0a9b8f7175b983c012fa530bb29693cd8aadf2b2feb0f56d1c089fac20edb4
SHA512:	8c86d2c46d5eac37eaf7ca2612a395a52811e12a4d1653e410ccfc609cf64ff25b0ec10c469f96467745ec553a2abf1a5d4259ac347d2e92083453ea64143b4d
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
TLSH:	4E645C1823EC8911E27F4B7994A1E274D375ED56A452E30F4ED06CAB3E32741FA11AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF0DBE6BE [Sun Jan 19 04:14:54 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F72C515B7C2h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F72C515B7C2h
jnc 00007F72C515B7C2h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F72C515B7C2h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F72C515B7C2h
je 00007F72C515B7C2h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F72C515B7C2h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F72C515B7C2h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b95c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b940	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e994	0x2ec00	64c48738b5efa1379746874c338807d5	False	0.4696168950534759	data	6.205450376900145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9d4	0x1cc00	5b3e8f48de8a05507379330b3cf331a7	False	0.23725373641304348	data	2.6063301335912525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	f921873e0b7f3fe3399366376917ef43	False	0.025390625	data	0.05390218305374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x35a	data	0.4417249417249417
RT_MANIFEST	0x4e7e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-14:27:04.417356	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	2630	49730	103.113.70.99	192.168.2.4
04/24/24-14:26:58.880918	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	2630	192.168.2.4	103.113.70.99
04/24/24-14:27:11.399846	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	2630	192.168.2.4	103.113.70.99
04/24/24-14:26:59.108894	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	2630	49730	103.113.70.99	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 14:26:58.376689911 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:26:58.597362995 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:26:58.597574949 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:26:58.606741905 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:26:58.847655058 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:26:58.880918026 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:26:59.108894110 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:26:59.152460098 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:04.173125982 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:04.417356014 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.417375088 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.417387009 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.417393923 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.417414904 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.417499065 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:04.464941978 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:04.550640106 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:04.820612907 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.875916958 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:04.886518002 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:05.108470917 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.108499050 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.108513117 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.108707905 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.109575033 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.114157915 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:05.334954023 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.386831045 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:05.394545078 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:05.614743948 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.614784002 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.614803076 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.614820957 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.614943027 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.615020037 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.615104914 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.615828991 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:05.668076992 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.047282934 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.278096914 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.290587902 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.339921951 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.451994896 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.672363043 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672468901 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.672564030 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672610998 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672637939 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.672653913 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672677040 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.672715902 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.672813892 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672878027 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.672902107 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672947884 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.672955990 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673002005 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673091888 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.673166037 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673383951 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.673446894 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673526049 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.673573017 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.673588991 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673628092 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673696995 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.673762083 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.673818111 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.673887014 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.674016953 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.674083948 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.674101114 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.674160004 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.674308062 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.674369097 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.674436092 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.674515963 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.894922972 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.894994974 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.895040035 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.895217896 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.895365953 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.895385981 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.895479918 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.895550013 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.896866083 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.896960020 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:06.897223949 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:06.897347927 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.115726948 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.115747929 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.115768909 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116020918 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116183996 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116297007 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116408110 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116583109 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116739035 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.116971970 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117043018 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117151976 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117403984 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117568016 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117670059 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117778063 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117824078 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117856026 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.117973089 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.118144035 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.118669033 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.118968964 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.119146109 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.119884014 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.119949102 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.119983912 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.120140076 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121084929 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121164083 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121180058 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121242046 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121710062 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121804953 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121875048 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.121892929 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.122132063 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.122203112 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.122462034 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.122584105 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.352596998 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.352708101 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.353087902 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.353529930 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.353746891 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.353817940 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.353872061 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354118109 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354208946 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354207039 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.354388952 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.354418993 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354477882 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354578018 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354593039 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354754925 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354769945 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.354876995 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.355209112 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.355348110 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.584726095 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.584753990 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.584860086 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585055113 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585225105 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585483074 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585589886 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585606098 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585630894 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585887909 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.585895061 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.585968018 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.586016893 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.586082935 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.586199999 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.586401939 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.586652040 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.586760998 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.827348948 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.839394093 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.839540958 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.839567900 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.839720964 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.839773893 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.839876890 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.840012074 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.840122938 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:07.840173960 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.840256929 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:07.840394974 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.066809893 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.067055941 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.067162037 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.067333937 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.067509890 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.070734024 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.075124979 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:08.296367884 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.301059008 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:08.521739960 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.523138046 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:08.743813038 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:08.794384956 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:08.799320936 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:09.032887936 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:09.035561085 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:09.280891895 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:09.324299097 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:09.414216995 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:09.641150951 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:09.646511078 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:09.877763033 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:09.904062033 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:10.124735117 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:10.139179945 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:10.361572027 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:10.364269972 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:10.592441082 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:10.595978022 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:10.826086044 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:10.871201992 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:10.909518957 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:11.164067030 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:11.164844990 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:11.398585081 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:11.399846077 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:11.621273994 CEST	2630	49730	103.113.70.99	192.168.2.4
Apr 24, 2024 14:27:11.668039083 CEST	49730	2630	192.168.2.4	103.113.70.99
Apr 24, 2024 14:27:11.678188086 CEST	49730	2630	192.168.2.4	103.113.70.99

Target ID:	0
Start time:	14:26:55
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\gm5v3JlTMk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gm5v3JlTMk.exe"
Imagebase:	0xbc0000
File size:	312'891 bytes
MD5 hash:	79FC20C78E45D10F5F6D3F12C736B8D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1641741658.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1792581225.0000000003198000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1792581225.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	7

Executed Functions

Function 06803F50 Relevance: 1.8, Strings: 1, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$qq, xrefs: 068041E4

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: $qq
API String ID: 0-87942743
Opcode ID: 054df31e218e467037ee2bd9d3d6d1068d6daaacc3257dd919da5dbbe78f01aa
Instruction ID: 5b90d4b7a00ebdef23f330224de3b2ab7cdbe579f3f6f07c85658d8a674c950d
Opcode Fuzzy Hash: 054df31e218e467037ee2bd9d3d6d1068d6daaacc3257dd919da5dbbe78f01aa
Instruction Fuzzy Hash: 14128074B00215DFDB94DF68C854A6EBBF6BF88700B158569EA05EB3A5DB30DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068067D8 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b53ce662a6dc0ec73b201ae9ddca50264870f128896da93355dd731aa4fcee0
Instruction ID: d139dd2608a843f2f3134fc826f0e68cf0e85e54f07703fe29848cc7a7f31a9f
Opcode Fuzzy Hash: 2b53ce662a6dc0ec73b201ae9ddca50264870f128896da93355dd731aa4fcee0
Instruction Fuzzy Hash: 72F1C671A002199FDB55DF68D880B9EBBF2FF45310F148969E509EB2A1EB30DC95CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0680A3D8 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4439a663f414fa62edc55b260425629efa231f2caaeccbf15ddcbaaa80e5cf4
Instruction ID: 50e5c0e774e70e581605ea18ff471e47fe6383a1f5463e0056c6e919a015e9a4
Opcode Fuzzy Hash: d4439a663f414fa62edc55b260425629efa231f2caaeccbf15ddcbaaa80e5cf4
Instruction Fuzzy Hash: FBD1F670900318CFDB18EFB4D844AADBBB2FF8A301F2085ADD51AAB294DB355885CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0680A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dbe666b2bbb49e9513f86895d42fc803dec0090b0f8d24c4de3e20315080dbe
Instruction ID: 2b2251d953e00bed159a03c4277bf84bdde1b02473164a0d7b9bb6e105b736ba
Opcode Fuzzy Hash: 1dbe666b2bbb49e9513f86895d42fc803dec0090b0f8d24c4de3e20315080dbe
Instruction Fuzzy Hash: 5CD1E670900318CFDB18EFB5D854AADBBB2FF8A301F1085ADD51AAB254DB359985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 067F0D80 Relevance: 20.6, Strings: 16, Instructions: 626
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$qq, xrefs: 067F0FAC
$qq, xrefs: 067F0E78
$qq, xrefs: 067F0FB8
$qq, xrefs: 067F137B
$qq, xrefs: 067F13EB
$qq, xrefs: 067F13AC
$qq, xrefs: 067F0E84
$qq, xrefs: 067F0F86
$qq, xrefs: 067F1455
$qq, xrefs: 067F0F36
$qq, xrefs: 067F0E02
$qq, xrefs: 067F0E52
$qq, xrefs: 067F1336
$qq, xrefs: 067F1430
$qq, xrefs: 067F13A0
$qq, xrefs: 067F1461

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: $qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq$$qq
API String ID: 0-3343575084
Opcode ID: fd18a6ef0a1d4bb14b292ed7925958b74f6b6074a75a11de153323891dbef962
Instruction ID: 0b396efe9f00d8131bc6d0b4266ede41f338d269d4a0e371629bbc222604b391
Opcode Fuzzy Hash: fd18a6ef0a1d4bb14b292ed7925958b74f6b6074a75a11de153323891dbef962
Instruction Fuzzy Hash: 8232AD30B20205DFDB559B69C854A7ABBF6BF89310F15845AEA06DB3A2CF34DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067F1582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$qq, xrefs: 067F1A88
$qq, xrefs: 067F18E3
$qq, xrefs: 067F1A57
$qq, xrefs: 067F1A7C
$qq, xrefs: 067F1A12
$qq, xrefs: 067F182E

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: $qq$$qq$$qq$$qq$$qq$$qq
API String ID: 0-1822695862
Opcode ID: 0a1963e8d41a2e2f2a84a2148b799e96433c095b27cb8482752955050213a4f2
Instruction ID: 98bddbcec9c163ac35b320a92dca3e34ff6155c7ca7908ac42b8d285a31c3100
Opcode Fuzzy Hash: 0a1963e8d41a2e2f2a84a2148b799e96433c095b27cb8482752955050213a4f2
Instruction Fuzzy Hash: 27C1E230B24205DFDB559BB9C894A3EB7E6EF99300F508469E6068B3A2DF75DC01C791

Uniqueness

Uniqueness Score: -1.00%

Function 0177AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0177B086

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5680119e196de6a37d511a4c93d18473b46dc56f6e21f55b16ee9b48c09d1d77
Instruction ID: a363668da3d0afcfab44a2711b11b307c483f629eca5bb416389dd97f7b17757
Opcode Fuzzy Hash: 5680119e196de6a37d511a4c93d18473b46dc56f6e21f55b16ee9b48c09d1d77
Instruction Fuzzy Hash: 608125B0A00B458FEB25DF29D44475AFBF1FF88204F04892DE58AD7A90D775E949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01775935 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017759F1

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d3002ffb3e3aafb8cfb85125e175a3cb90c5b570ce226b92b67af34d315e2094
Instruction ID: 93fe2f206fb40238a3bf1729b50f6fcf72d7d46a448dad9af11b3b1cf5afc26c
Opcode Fuzzy Hash: d3002ffb3e3aafb8cfb85125e175a3cb90c5b570ce226b92b67af34d315e2094
Instruction Fuzzy Hash: C441E1B0D0031DCADB24DFA9C884B8EFBB5FF49304F20806AD509AB251DB756A49CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01774248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017759F1

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 66a0d3a16d3011db5f0061edef8ad2262613a56d03eb06f12a8942b7550e69da
Instruction ID: 641bcfb1f915ed8fe8c7b11da2bc3623568ca8d39235ca341d7c7c56982f8cd2
Opcode Fuzzy Hash: 66a0d3a16d3011db5f0061edef8ad2262613a56d03eb06f12a8942b7550e69da
Instruction Fuzzy Hash: A641F1B0D0071DCADB24DFA9C884B8EFBB5FF49304F20806AD519AB251DB756A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0177C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0177D2C6,?,?,?,?,?), ref: 0177D387

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 17dcb7ece5df8ceceb4d2bbd16f7f1256205d621ca4f701d046d1e4fede012a5
Instruction ID: 85e10e0481df385f3da300431ae03de465f4518c56e2e567237373ebad12948f
Opcode Fuzzy Hash: 17dcb7ece5df8ceceb4d2bbd16f7f1256205d621ca4f701d046d1e4fede012a5
Instruction Fuzzy Hash: BB21D2B5900248DFDB10CFAAD984AEEFBF9EF48310F14845AE918A7250D374A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0177D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0177D2C6,?,?,?,?,?), ref: 0177D387

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cad9d010b80d00f3e94f0b1224a51f7070611d252e96b9a9bb2dd9337f09aea1
Instruction ID: c63a763c9115801a0e53e2612b3192093b0ff1b8f5b4dc51a219265bef9c7daa
Opcode Fuzzy Hash: cad9d010b80d00f3e94f0b1224a51f7070611d252e96b9a9bb2dd9337f09aea1
Instruction Fuzzy Hash: DC21D4B5900349DFDB10CFAAD484ADEBBF9EB48310F14841AE918A3250D374A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0177A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0177B101,00000800,00000000,00000000), ref: 0177B312

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4367d7f0bdf52f98c8cf973a2261d06df8e3bac0b182d14088b27bf0f96e8f96
Instruction ID: 21deb47cbbeb3af379102351cbc60e0779ac15901b30648579e1c906fdd3aa4d
Opcode Fuzzy Hash: 4367d7f0bdf52f98c8cf973a2261d06df8e3bac0b182d14088b27bf0f96e8f96
Instruction Fuzzy Hash: C11114B68043499FDB10CF9AC448ADEFBF8EF88310F10842ED919A7210C375A544CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0177B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0177B101,00000800,00000000,00000000), ref: 0177B312

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9278ed1f9299ec93d2623158f0b84c21ffc5f982b2c773f3eef7b32fb685d46e
Instruction ID: c2c2d28b767b3d6dcd3ffe42d3b29c7212c902e68d860fd1e0a2ebfd7b5251d5
Opcode Fuzzy Hash: 9278ed1f9299ec93d2623158f0b84c21ffc5f982b2c773f3eef7b32fb685d46e
Instruction Fuzzy Hash: 961126B68003498FDB14DF9AC444ADEFFF4EF88310F14842AD919A7211C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0177B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0177B086

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 71bae35689b14d13496e1496f24f17ddfcc88bf0804b5c85a23a0d924e04b562
Instruction ID: 6a0afd01522a253921df769f6507dcb13c4f9fb85bdb383e95240c16465a9fe4
Opcode Fuzzy Hash: 71bae35689b14d13496e1496f24f17ddfcc88bf0804b5c85a23a0d924e04b562
Instruction Fuzzy Hash: 2311D2B5C00349CFDB14DF9AC444A9EFBF4EB89214F10846AD529A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067F1BA0 Relevance: 1.4, Instructions: 1445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35b75ab7ad59453d941c006c9625d6d01940a35967055ae5be2820243fbcede
Instruction ID: f0384aa247442e626d5b70a92427c7673874a4592e17238c2105ddc288011a91
Opcode Fuzzy Hash: c35b75ab7ad59453d941c006c9625d6d01940a35967055ae5be2820243fbcede
Instruction Fuzzy Hash: BCC24F70B102189FCB54DF64C855EADBBB6FF88700F118099E61A9B3A2DB719E41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06803DE0 Relevance: 1.4, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'qq, xrefs: 06803F25

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: 4'qq
API String ID: 0-1915349394
Opcode ID: e512d94872b57350da98b5e8bcc820a49319b68f9d297e1cced64bcc9aa4382b
Instruction ID: 4f455a45f85c661d53da4b467965f332b4c192ee2953a309a8fcd3ffd74e6bb2
Opcode Fuzzy Hash: e512d94872b57350da98b5e8bcc820a49319b68f9d297e1cced64bcc9aa4382b
Instruction Fuzzy Hash: 40315131B143524FCB66AB78A8504AE7BE2DFC661031949BEE509CFB91DE20DC47C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 068084D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'qq, xrefs: 068085B1

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: 4'qq
API String ID: 0-1915349394
Opcode ID: a8c2eec6927ff6a535dd1686aa66be267b56658dba1e227d556a0e7919dd1bad
Instruction ID: 4a86de98615b9c2b00589df23dd3a3c603b443469a9d649e1100aaffa1331998
Opcode Fuzzy Hash: a8c2eec6927ff6a535dd1686aa66be267b56658dba1e227d556a0e7919dd1bad
Instruction Fuzzy Hash: 6B318E717002169BCF09EB79A8A867F7AE7EFC8201B504439D60ACB385EE35DC4697D1

Uniqueness

Uniqueness Score: -1.00%

Function 068084C8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'qq, xrefs: 068085B1

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: 4'qq
API String ID: 0-1915349394
Opcode ID: 9f26b227bd18a39311585f690244f6ff146bd393d12907948436ba7bc1bbc669
Instruction ID: 67f7aca748ffb223d8d6eadcccd5da4cd2e6c8680e91f0dfbd5087b67fd92148
Opcode Fuzzy Hash: 9f26b227bd18a39311585f690244f6ff146bd393d12907948436ba7bc1bbc669
Instruction Fuzzy Hash: FC21B470B003169BCF49AB78A46863F7AE7AFC9201B50483DD60ACB385EE75DC4597D1

Uniqueness

Uniqueness Score: -1.00%

Function 0680B358 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4'qq, xrefs: 0680B399

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: 4'qq
API String ID: 0-1915349394
Opcode ID: c8784a37a5861d77d08b349538d4d13af16793b26a406e5255a089e5cbeb70de
Instruction ID: b0954c0521d3b774040e862b3763f0b505b17a8c1c92d33e1abc990682b39627
Opcode Fuzzy Hash: c8784a37a5861d77d08b349538d4d13af16793b26a406e5255a089e5cbeb70de
Instruction Fuzzy Hash: 9201D23090A28AEFCB05EF78D88455CBFB1FF56241B1444EED68597741DA341D88CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0680B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'qq, xrefs: 0680B399

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: 4'qq
API String ID: 0-1915349394
Opcode ID: 3cebb0afb6205a686cc95690a6a7072028cd9076356abaa2cd38f7f081c8e7d1
Instruction ID: 9c72959715f1521f047b9f7a0143be74366fd746ff4242a5eb27062da5adc16d
Opcode Fuzzy Hash: 3cebb0afb6205a686cc95690a6a7072028cd9076356abaa2cd38f7f081c8e7d1
Instruction Fuzzy Hash: F6F04F74A0520AEFCB04EFB8E88455CBBB2FB94206F1485BDDA09A7714DB341E48CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067F45D0 Relevance: .9, Instructions: 942COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6391afdf926331cb647ddb8bb300a8686ae42a0941d3aebe02abf216eceb7163
Instruction ID: 807637615522e6339a8a6543acd5f86521a781ca5d67545ac7bfd0dbe5747a03
Opcode Fuzzy Hash: 6391afdf926331cb647ddb8bb300a8686ae42a0941d3aebe02abf216eceb7163
Instruction Fuzzy Hash: 37427030B102449FCB44DF69C954E6BBBF6EF89710B15809AE616DB3A6CB71DC01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 067F3928 Relevance: .7, Instructions: 713COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99eea4dcaa5d801e748f1427c7b87f082af109d688bf227a6febfaea60e7ba8
Instruction ID: 0b506c2956d7098680963b7104d98e888c3402e64f68fd33ff17784e6e8bd5a9
Opcode Fuzzy Hash: a99eea4dcaa5d801e748f1427c7b87f082af109d688bf227a6febfaea60e7ba8
Instruction Fuzzy Hash: C3523C74B102149FCB44CF69C994EAABBF6FF89704F118099E506DB3A2DA71ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067F00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bdde4798b2e7e8771f7dfa6f9bc6b16440c248cc337eb953ee09ca376849d0
Instruction ID: 8d059190ed56d31d39c3ddc3cc8973a3e8a061c4e24e1d8e8aa11d26e5dbb60b
Opcode Fuzzy Hash: 27bdde4798b2e7e8771f7dfa6f9bc6b16440c248cc337eb953ee09ca376849d0
Instruction Fuzzy Hash: 474278707206298FCB64DB78D450A2EBAF2FFC5705B40496CD6079B792CB7AEC058B85

Uniqueness

Uniqueness Score: -1.00%

Function 067F00B8 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c028047fcb33a236f41f915c12ec3686327679f357c519e73cb70baf1d732a3
Instruction ID: 3789248199d0a4f9de80b51eaf4ec603b4ca56c856c85a13901740a27ecc5bef
Opcode Fuzzy Hash: 2c028047fcb33a236f41f915c12ec3686327679f357c519e73cb70baf1d732a3
Instruction Fuzzy Hash: 06C16B34B212049FDB44DB65C869B797AF6FF89704F108069EA029B3A7CB75DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067F0756 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b666d9231d5be69ae21daf1fcf4bfcf2731c424e1e2d8b3fa06e7d478eaf444
Instruction ID: 3bdc25bd9b53753ddcd42e9c6155d6a4d7b6fda916e1348f01ca62bfd151129c
Opcode Fuzzy Hash: 1b666d9231d5be69ae21daf1fcf4bfcf2731c424e1e2d8b3fa06e7d478eaf444
Instruction Fuzzy Hash: 8DB15E34B212049FDB44DB65C869F3976E6FF89704F108069EA029B3A7CB76DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067F0666 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbd3b647d45a9bac1839ca5fbba645e9506631fcb6cc7397bc809749393cc3f
Instruction ID: 9626f644da4cad2562817cda03c9d1b254171de50924bdca6c60c8c465306c9c
Opcode Fuzzy Hash: cbbd3b647d45a9bac1839ca5fbba645e9506631fcb6cc7397bc809749393cc3f
Instruction Fuzzy Hash: 5CB15D34B212049FDB84DB65C869F3976E6FF89704F108069EA029B3A7CB76DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067F06DE Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2496553ec8a9d03cf560e758da8b0f5bc29ef001155bc5f6815e628c591a4060
Instruction ID: 47f63659dae1ae90ecfd9b6730ee05797966e212d227d759bf204a97737a65db
Opcode Fuzzy Hash: 2496553ec8a9d03cf560e758da8b0f5bc29ef001155bc5f6815e628c591a4060
Instruction Fuzzy Hash: 14B15D34B212049FDB44DB65C869F3976E6FF89704F108069EA029B3A7CB76DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067F05EE Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3bb6cb71f9e2015cd350a597c35f8d3a2415e3e18bc291b2aa0516dd06cc4df
Instruction ID: 7c7372c006d0778f1d2e799f066254f5b72f98f9897c347e7c6aba0246d8d36c
Opcode Fuzzy Hash: d3bb6cb71f9e2015cd350a597c35f8d3a2415e3e18bc291b2aa0516dd06cc4df
Instruction Fuzzy Hash: 1CB15D34B212049FDB44DB65C869F3976E6FF89704F108069EA029B3A7CB76DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06804AFF Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f48a67424a515a9b63066e1f553d3734afa24b2e6667f6168a3647749de110
Instruction ID: fc4ff3b4321bc3a3b3a965ce8bb7d74e10e49912f35670662ba5ea5e42f9dae3
Opcode Fuzzy Hash: 09f48a67424a515a9b63066e1f553d3734afa24b2e6667f6168a3647749de110
Instruction Fuzzy Hash: AAC12878B00605CFD754DF69C884AAEBBF2BF89301B1585A9E606DB3A1DB30EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06803F3F Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bd500cf07e79e7dd377cc9a334c725814a2a800301b77d2cb512b71f5d6da3
Instruction ID: b98d103f11753cbfd5f57e072669b759886d5713474a9f46da2207e71d96ec5e
Opcode Fuzzy Hash: 51bd500cf07e79e7dd377cc9a334c725814a2a800301b77d2cb512b71f5d6da3
Instruction Fuzzy Hash: 15616370F00215CFDB94DF69C8546AEBBF6BF98200B158569DA09E73A5DB70DC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06806408 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e602519e909694177dddb233030d9c9a4aa1b0a1c192827f646d1ea6448802a
Instruction ID: 543caadeaf8ccf65dcc2b5d55f5967b99d9f2cc4146db872111189e37e612303
Opcode Fuzzy Hash: 7e602519e909694177dddb233030d9c9a4aa1b0a1c192827f646d1ea6448802a
Instruction Fuzzy Hash: EC51A575B002059FDB94DF69D88099EBBF5FF88314B1588AAD505D7361EB30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06807D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6911cb0add07a17e26695be41982278ccefc8c56b50e34f7c1be7f777b9143
Instruction ID: 1f20a11ab2eb07c1ec8c77d4bee92e1a764196f80a38488d65aeb0a04ad72d00
Opcode Fuzzy Hash: dc6911cb0add07a17e26695be41982278ccefc8c56b50e34f7c1be7f777b9143
Instruction Fuzzy Hash: 515136B0E00258CFEB95CFA9C884BDEBBF5AF48700F148929D515EB294DB74A945CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06807D4C Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f692e62e5a29d1a3b4236a9f6746902bdecfbd516565c7cf51caa975713730cc
Instruction ID: 7558bfc8d0d236f06eac08bc366bfa2a52aec553be5d0d1ed043a9106783d33b
Opcode Fuzzy Hash: f692e62e5a29d1a3b4236a9f6746902bdecfbd516565c7cf51caa975713730cc
Instruction Fuzzy Hash: B65158B0E00249CFEB95CFA9C884BDEBBF5AF48700F148829D515EB294DB74A845CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0680E8B0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52928439f98273895892e975f81f86c28d53d7c2fbe5a1bd65e6dc42acc02c1f
Instruction ID: 9204b23a9e62c66d63f6716eb47bcb7fe5ca033250be4aeeddd57a13df5e4bf6
Opcode Fuzzy Hash: 52928439f98273895892e975f81f86c28d53d7c2fbe5a1bd65e6dc42acc02c1f
Instruction Fuzzy Hash: 3C411975A083458FCB569F78D81456E7FB2FF96300F5488AEE580CB392D6358D05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068059C8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc1b93d300eaef48bacd7bbfe57b2d8e9c414b40f6b086653a1d1dd10892a60
Instruction ID: 6f259ba2c6401bc03a336b345d3b436da8b529271662ebd6e565fd6e5b240e86
Opcode Fuzzy Hash: 0fc1b93d300eaef48bacd7bbfe57b2d8e9c414b40f6b086653a1d1dd10892a60
Instruction Fuzzy Hash: FF415935A006068FDB54CF58C98096ABBF2FF89310B558969E559DB2A1D730F801CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06806E90 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad07b086f2b5d2e941615cd5429dfd298eaf3bdc91bf6cdd7f8be2ba959a15a
Instruction ID: c92821ccff79ebc4658ef02ed4f2c37771fcf8505753207f5558a8eb85e0a97e
Opcode Fuzzy Hash: aad07b086f2b5d2e941615cd5429dfd298eaf3bdc91bf6cdd7f8be2ba959a15a
Instruction Fuzzy Hash: 414126B5505F948FC725CF2EC480897FFF4AF99210B04896EE9DA83B22D270E944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06805579 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af0017c5cb5c546d845a8a55a6369cd67438dd5c7de2e975ab765c736a74ae7
Instruction ID: dfab9826a62659a9bff84a816101c643ee87e1aaf88d7d9ce2dcc3f4dbc87d52
Opcode Fuzzy Hash: 2af0017c5cb5c546d845a8a55a6369cd67438dd5c7de2e975ab765c736a74ae7
Instruction Fuzzy Hash: DC318B78B012109FDB55DF38D88496E7BB2FF89201B44886AE905CB396DB30DD06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06805588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b231a1b5cb2633af8cbf87e41538d60102f8224a54e406459ff7d906bf5d77f
Instruction ID: 01bc92dd5cbc6c094fb8b6414f815df74d8941dd543ae40187c82bfbd4b64b7c
Opcode Fuzzy Hash: 7b231a1b5cb2633af8cbf87e41538d60102f8224a54e406459ff7d906bf5d77f
Instruction Fuzzy Hash: 96318978B012119FDB45DF38D88496EBBB6FF89341B508869E905CB395DB30ED02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 068087A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bff9639451e3396f5166b9c1c7183fb22fd02de56d29d1146ed4c6167a235c2
Instruction ID: c8183cea966b2287fb70cab6fba410f0aa1f24da011dd43fccb5d437dc91038e
Opcode Fuzzy Hash: 4bff9639451e3396f5166b9c1c7183fb22fd02de56d29d1146ed4c6167a235c2
Instruction Fuzzy Hash: 474102B1D01248DFEF58DFAAD944ADEFBB6AF88310F10842AD415B7294DB34A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06808795 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e5c45a0f50c6d979304a2ee11e1c0697580df0404dacd7366735fafc0881ae
Instruction ID: c77a963fd13f547b495b622169579a5bb543999efb586cb13cb339dce235bd71
Opcode Fuzzy Hash: f6e5c45a0f50c6d979304a2ee11e1c0697580df0404dacd7366735fafc0881ae
Instruction Fuzzy Hash: 423112B1D012489FEF58DFAAC944ADEBBF6AF88300F14842AD415AB294DB749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 067F37BB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3591f13cc17ce79d9703f01886d2431c4a8abea8112eb5f94814956315efbb19
Instruction ID: a161d736a900b4a035b5c0932880b61c7d5e4d5d3e83d9771e3bd97be2c59ed3
Opcode Fuzzy Hash: 3591f13cc17ce79d9703f01886d2431c4a8abea8112eb5f94814956315efbb19
Instruction Fuzzy Hash: 8B213075B501049FCB54DF65D584EA9BBB2EF88714F1580A5FA059F3A1DA31EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 067F30FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647b20222942d249ed9565b5cc602a1fab1b756ce2252fef4afe3f0c7bb0b3b8
Instruction ID: 8f30e9120c885468f20f860691641edad11ad2a2aa3e8e52d8b06d459e43eb52
Opcode Fuzzy Hash: 647b20222942d249ed9565b5cc602a1fab1b756ce2252fef4afe3f0c7bb0b3b8
Instruction Fuzzy Hash: 02214135B501049FCB54DF69D984EA9BBB2FF88714F1680A5FA059F3A2DA31EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067F360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805989098.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67f0000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1b273ccb8585561728a9e1e1e8a373eca27f92e80c23b49ec159e0520e283a
Instruction ID: 9a8d1efde33e071715eb109d9ae00b745c837ad460c23838eb01f60782e0f266
Opcode Fuzzy Hash: 2d1b273ccb8585561728a9e1e1e8a373eca27f92e80c23b49ec159e0520e283a
Instruction Fuzzy Hash: 39214135B411149FCB54DF65D984DAABBB2FF88714F1180A5FA0A9F3A2DA31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06808A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93dd86d4dbf5c4dadf7b12300807fa1ebb388120dfed5763ace5e8f4cb59543
Instruction ID: be84a4f22620901ec6ab6c55547d542babeeab235a49e2d2fd0935ff410c2f11
Opcode Fuzzy Hash: b93dd86d4dbf5c4dadf7b12300807fa1ebb388120dfed5763ace5e8f4cb59543
Instruction Fuzzy Hash: F53112B1D01258DFDF54DFA9D894ADEBBF9AF48310F24842AE409E7380CB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788614728.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12fd000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1923af3198586ea920a285523dff2f1b75c566d6bba386741fc4da3026045b3
Instruction ID: 4b2c81d5c2fe918885b6adba7296c22f58ee7dc0354facf25287a70e69079941
Opcode Fuzzy Hash: c1923af3198586ea920a285523dff2f1b75c566d6bba386741fc4da3026045b3
Instruction Fuzzy Hash: D92102B5510209DFDB05DF48C9C4B56FB65FB94324F20C56CDA0A0A246C336E416CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788637772.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18eb313da3a44c8f46d86b53b098594ca46a25483bf7d52f5431e681d3a8e78a
Instruction ID: 1ff379c544e343caf6a5fe6d88cff6b95a4844b1efe68e0556137811e986ab58
Opcode Fuzzy Hash: 18eb313da3a44c8f46d86b53b098594ca46a25483bf7d52f5431e681d3a8e78a
Instruction Fuzzy Hash: 5C210371604204DFDB16DF98D894B16BBE5FB84318F20C56DD80E4B786C336D407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06808F43 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcd5b1cecc96e6e43505d88358ef24fa7b5add850a362aa81dcff4b8e001bd1
Instruction ID: acb31a1c17719c47fca3c02b84cafc55341699296edf6a96b444d0512c682066
Opcode Fuzzy Hash: 9fcd5b1cecc96e6e43505d88358ef24fa7b5add850a362aa81dcff4b8e001bd1
Instruction Fuzzy Hash: A621FEB4E0120ADFDF80DFA8D8846ADBBB4FB08311F1044AAE915E7390D3745A81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06808A8C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86421f342d1e9e2b09265be1a9dd1f77d6a11329103e1a034b417a05cc833c84
Instruction ID: 4fb802067ea70084972e498800bde718ce123cbe3ffc95ced873a8cfc1e570e4
Opcode Fuzzy Hash: 86421f342d1e9e2b09265be1a9dd1f77d6a11329103e1a034b417a05cc833c84
Instruction Fuzzy Hash: 472135B1D01248DFEF54DFA9C895B9EBBF9AF08300F24842AE404E7380CB749985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06805498 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed7fd2b4f0ebd8cdb65c4a716f9c5818ea75ad3e23314c5a7e1611fab678d19
Instruction ID: 21cf107454b505d40d235d3103a76bc58605b569e973f53d7bce7a2ce5faa449
Opcode Fuzzy Hash: 7ed7fd2b4f0ebd8cdb65c4a716f9c5818ea75ad3e23314c5a7e1611fab678d19
Instruction Fuzzy Hash: 22117B34A08B508FE7F28A244E401BE7BB29F82205B088C9AD141C65E6D175E481CB63

Uniqueness

Uniqueness Score: -1.00%

Function 012FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788614728.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12fd000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 03e38820ab5bc20717997455d1a05b91d47e883232222b35e1429fa90f5a035f
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: F011CA76504285CFDB02CF44D9C4B56BF72FB84224F24C2ADDA090A656C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0680BC5F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca9a5bcab1e02d4850b76930c867641dd37b04e2f1e9fe28b1a73c2dad7d334
Instruction ID: 2291b9667ff66f4ba22600e4c7cac965eb5fe124b522aa99668646e71c7d9410
Opcode Fuzzy Hash: 0ca9a5bcab1e02d4850b76930c867641dd37b04e2f1e9fe28b1a73c2dad7d334
Instruction Fuzzy Hash: 1611A1312102134FC7A6AB34A85497DBBE3EFE22467544C2DE64BC7B40DD30688BC791

Uniqueness

Uniqueness Score: -1.00%

Function 0130D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788637772.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: e386d63d023d2c68435b9ea0c7873dd9379ad65e30e450a9a22913bdb9689a06
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: D311BE75504280CFDB12CF54D5D4B15BBA2FB44328F24C6A9D8094B696C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06808350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d51a058cf31acf8d6b260119cc52307827714286737c072338dd32e089d8f3a
Instruction ID: 0f332c214c891faf551c58a8311fe7726ea19742f8e508ef54db2ac327302a6a
Opcode Fuzzy Hash: 7d51a058cf31acf8d6b260119cc52307827714286737c072338dd32e089d8f3a
Instruction Fuzzy Hash: 63018871B102199BDF54DE69DC84ABFF7BAFBC8251F148036E604D3240DF30991597A1

Uniqueness

Uniqueness Score: -1.00%

Function 0680C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363960f3c6c78accd975bf4d7b76ba8517592104a85b7de0317ffd2b2a6992fe
Instruction ID: e22fd1b2a047775f14ecfec716bc82fd7f98b7fbc14614d179ae584acd6b1e26
Opcode Fuzzy Hash: 363960f3c6c78accd975bf4d7b76ba8517592104a85b7de0317ffd2b2a6992fe
Instruction Fuzzy Hash: B811A0302047058FD321AF65E80466ABBE2EF96302B10892ED18A87684CB749C4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0680BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79c861766488bad9eace3310099252b46f40a0255b680e62bc1bc1f2f97ef68
Instruction ID: 5f5904a3d600d687dd18152d9c1196200a29fc34c0e438a257b4f5bca9f3d719
Opcode Fuzzy Hash: f79c861766488bad9eace3310099252b46f40a0255b680e62bc1bc1f2f97ef68
Instruction Fuzzy Hash: 3D015E312102174F86A5A738E45493EBAA3FFF1296754482DE60B87B40DD70798A8791

Uniqueness

Uniqueness Score: -1.00%

Function 012FDAA5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788614728.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12fd000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d46ae984d432b056a5e78e47e3c8e5158e204de0e4997acd6e4a6f2342c4e7
Instruction ID: 056dc22892a75b0bd3483eb0e76c6a518b02c20f82ba47f864a8a18e2652863e
Opcode Fuzzy Hash: d7d46ae984d432b056a5e78e47e3c8e5158e204de0e4997acd6e4a6f2342c4e7
Instruction Fuzzy Hash: 5C01F7711183489AE7119E69CC88727FFE8EF51321F08C86EEF190A282C7799844C771

Uniqueness

Uniqueness Score: -1.00%

Function 0680C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caafde6d7057d66bd98e92cab18e024b16b8f816433c3ca61253313be838813e
Instruction ID: 338c4d177934bf546070ed78e4f3f86b14c7b7af89ae46db7b96527cf659d9b4
Opcode Fuzzy Hash: caafde6d7057d66bd98e92cab18e024b16b8f816433c3ca61253313be838813e
Instruction Fuzzy Hash: 310180742002098FD324AF65D44466AB7E3FBD9312B108A2DD24A87744CF74AC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 06805508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f95e239603777d12430655046b532ad9d834a1e3197bdac4236b640914be09
Instruction ID: c9202d94a294e880fb2b3bbd31f8c6949f0cf428dfca259bf0e9eaf3fbafd73e
Opcode Fuzzy Hash: 53f95e239603777d12430655046b532ad9d834a1e3197bdac4236b640914be09
Instruction Fuzzy Hash: A401A238A11711CFEBE48A29AA0562B77F7BF842097048C29E506C6594DB71E480DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06808F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfff7f84ec269d239c653b51007c1226e5b12f941ab4aec70f05d3b36f4c809
Instruction ID: 8476b5dcf391e15a785427d937864a6ec7bdbebf00745d08d17408a4e8eabf96
Opcode Fuzzy Hash: 9bfff7f84ec269d239c653b51007c1226e5b12f941ab4aec70f05d3b36f4c809
Instruction Fuzzy Hash: 7A01C4B4D05209EFDB84DFA9D9456AEFBF5BB48301F1084AAD915E3380E7740A80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 068067C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d917d29e83b2aa83ec9eed050bce0f0d10e8ddd8f3e226c0fee6a9688165354
Instruction ID: a4cd9aa3776de358bf1c473f88648e24325c2489f71eaa0be6f5657f45090cfd
Opcode Fuzzy Hash: 7d917d29e83b2aa83ec9eed050bce0f0d10e8ddd8f3e226c0fee6a9688165354
Instruction Fuzzy Hash: 0BF0F031B403005BE7A08A28AC04F597FE49B42711F148A66F314CB1E2E6B1E885A740

Uniqueness

Uniqueness Score: -1.00%

Function 012FDAA4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788614728.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12fd000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f084a37a45c4a8722b161694148e52e077ba4686d36be2e2862e08261440f37
Instruction ID: 90e7d74a4b58a0ee7da451f4a0ff9e1363de34f54d2187bf9f8c4b1dbaac0dd5
Opcode Fuzzy Hash: 9f084a37a45c4a8722b161694148e52e077ba4686d36be2e2862e08261440f37
Instruction Fuzzy Hash: 69F0C2720043489EE7118E1ACC88B62FFE8EB41634F18C45EEE084B296C379A844CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 06806EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b5b85ada9de9e030cdf93845d73a645a8c757c9e6b62995e96781c61b310f8
Instruction ID: e6799098e7dae1ef2031fe80d5cd74cdece96668543c6b31a90e891e476f7b69
Opcode Fuzzy Hash: 42b5b85ada9de9e030cdf93845d73a645a8c757c9e6b62995e96781c61b310f8
Instruction Fuzzy Hash: 7AF037762041E83F8B518E9A5C10CFB7FEDDA8E161B09416AFFD8D2142C529CD61EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0680ADE9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1dc96244f2e3e289fab01cec9ef3536dbaeaa6dd3c9c03517ded086f9481011
Instruction ID: 00277b60e3a5ba3e71b0e3120266cc779f8daafdedfe5269ed89be32ddac1f3d
Opcode Fuzzy Hash: c1dc96244f2e3e289fab01cec9ef3536dbaeaa6dd3c9c03517ded086f9481011
Instruction Fuzzy Hash: DDF0EC712052515FC3556F69A884AAFBFE6EFCB251F40486EE25EC3246CA35084DC771

Uniqueness

Uniqueness Score: -1.00%

Function 06808340 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e6a8418d0defc49aafb6cde63d9cabc0943f79733ef2f961a5068ccd980ad5
Instruction ID: 185f37c8b1542e27b128abe6146becbd051dec8a9a8e6a6a3e6d7693e69120af
Opcode Fuzzy Hash: 90e6a8418d0defc49aafb6cde63d9cabc0943f79733ef2f961a5068ccd980ad5
Instruction Fuzzy Hash: 01F0E971B143155BDF509A69AC44ABF7FE9EFC5251F09443AE944C3240EB309400C792

Uniqueness

Uniqueness Score: -1.00%

Function 0680C110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635924f3e70c9987914f524676075168b292da70bf97ba338e61802ffd941c1f
Instruction ID: 9acfe0da3948d6a518451cb1b090a1f7ea423a0df41a99173f6e99982ade8cef
Opcode Fuzzy Hash: 635924f3e70c9987914f524676075168b292da70bf97ba338e61802ffd941c1f
Instruction Fuzzy Hash: 81F0F6302097E14FC3229739EC1465A7FE6DF97205F08089EE2C6C7652CBA55D49C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0680C170 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c7832df1bebb1f176c971c0576f4326fdd05e3fdc9b0ab5f2959af22c44015
Instruction ID: d04557ba5f14d07359f5f26021905ca8feedaaa2df6d3ba089b235b707ac1ec9
Opcode Fuzzy Hash: 83c7832df1bebb1f176c971c0576f4326fdd05e3fdc9b0ab5f2959af22c44015
Instruction Fuzzy Hash: 8201D131505B428FD326DF26E848121BFF2FF89300740C92EE4CA83A55CB34A48ACF40

Uniqueness

Uniqueness Score: -1.00%

Function 06808FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68679cc379e0c718a52b0e448e2d0bf4991a74e15bd6e42cb9591eaf3a22c095
Instruction ID: cd4e99a3c2bedd5a2cbf0384afb61aa25cf2f0664958306c8ffdd831c965562c
Opcode Fuzzy Hash: 68679cc379e0c718a52b0e448e2d0bf4991a74e15bd6e42cb9591eaf3a22c095
Instruction Fuzzy Hash: 2EF0CDF1D09249DFEF80CFB4C8061ADBFB0EB2A201F0046C6E806E7391E2784A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0680ACB8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa4c7c066d38dd06d6b8015432b6767730e5b1963c5e92de6127e4545dfe65e
Instruction ID: 9f46e84d0a3cb48355dbe1a6ebcea80d22a9a184819821b7a8009d55806336c2
Opcode Fuzzy Hash: eaa4c7c066d38dd06d6b8015432b6767730e5b1963c5e92de6127e4545dfe65e
Instruction Fuzzy Hash: B0F027F67092618FD3571B786C181BC3FA6EA9A25230408DFD287CB296CA244507C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 068054F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2ce6baf508abfa19571f4d6ffeab8fef0b0d97c80c283441792178fa20ebf5
Instruction ID: b5da45acbc692f1cf0c04db2febf4702493de79b7be6e62135477845d780c5d4
Opcode Fuzzy Hash: fe2ce6baf508abfa19571f4d6ffeab8fef0b0d97c80c283441792178fa20ebf5
Instruction Fuzzy Hash: E2F02439500B01CFEBE4CE31DA01B6B7BF2AF80315F088C6DE442869A5D6B4E484CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0680ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dd8449c54158c93647773b703f772b207126cfa971962c61dd4a89d1a05af7
Instruction ID: 8cba8d1a7a7ef5276756e36ef7cf3004ae325feed634bc51bdd55a11ad4c9bb6
Opcode Fuzzy Hash: e4dd8449c54158c93647773b703f772b207126cfa971962c61dd4a89d1a05af7
Instruction Fuzzy Hash: 53E012712041116BC7146A9AA489AAFBADAEBC9751F40453DE20EC3645CE61580587B5

Uniqueness

Uniqueness Score: -1.00%

Function 06805698 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da65ccbda671eb1b828a081c59c65c07eb3797b4685544684418ffff9df8746
Instruction ID: 63bbcc9d38f2e97fe0bb3bfb7216f31d29f08b3e9885ffe8622f57052f7c6af7
Opcode Fuzzy Hash: 5da65ccbda671eb1b828a081c59c65c07eb3797b4685544684418ffff9df8746
Instruction Fuzzy Hash: 3CE06DB210D2119FE341DA20AC4489B7BE8EFA1220B158C7EE544C7281E671D842CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0680C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1741fbf06a0277c20c00340f2630d4f67ee707b4eae4875abea76c46b17e80e5
Instruction ID: 770f639f1fefda8e0fae07e10ca38277a0bb451e50558e33e44483e6f1bdc1e5
Opcode Fuzzy Hash: 1741fbf06a0277c20c00340f2630d4f67ee707b4eae4875abea76c46b17e80e5
Instruction Fuzzy Hash: BFF09034500B069FD725DF26E448522FBF6FB88300700C62EE58A82B14DB75A549CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0680B500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa593d0edccf098d838f7f6cf92bae9bb0fb81bd267980d19ed84133409929c
Instruction ID: 01a71d37a57d3dd3704a3c02f1746c7047e58ac789de3cf0af3c47b10d681c11
Opcode Fuzzy Hash: faa593d0edccf098d838f7f6cf92bae9bb0fb81bd267980d19ed84133409929c
Instruction Fuzzy Hash: 14F01535D0120DAFDB01DFB4E9489CDBFB9EB44204F1082AAD945E2240EA305B55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0680C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e49adfd61ee2230139693e4790efcc964793073c719a1f6f4b0892fe8a1ff1
Instruction ID: a9046da1a34ff0d6c3ef0e5b957f38081f963a9e454901962f057cd1e4716e12
Opcode Fuzzy Hash: e6e49adfd61ee2230139693e4790efcc964793073c719a1f6f4b0892fe8a1ff1
Instruction Fuzzy Hash: D0E065302047654FC721E72DE8487AE7FE6EF99315F04492EE34687741CBB5AC458791

Uniqueness

Uniqueness Score: -1.00%

Function 0680CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf02d6f7b2f9c0ad3853520f20c8fa97f50aae56c6432fc576fed966a20b3ae0
Instruction ID: 31dd6f74dfafaf2dd912b5e72aa9aff0c000e7ad3ce2894df0d898e00bf5bfe6
Opcode Fuzzy Hash: bf02d6f7b2f9c0ad3853520f20c8fa97f50aae56c6432fc576fed966a20b3ae0
Instruction Fuzzy Hash: 32E092312056928FD762DF24F8409E97FA0DB52211B0545BBD080D7E52C63C0C4A87D6

Uniqueness

Uniqueness Score: -1.00%

Function 0680E280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e842ad354d0db137cc86a355b47bf6ee9cbe56b5e9ad6f59d245d1430f5e21cf
Instruction ID: fc95f383474ab602d29dbf8904103753d8af809ebc8c3742e9a7420129e4f41a
Opcode Fuzzy Hash: e842ad354d0db137cc86a355b47bf6ee9cbe56b5e9ad6f59d245d1430f5e21cf
Instruction Fuzzy Hash: B9E020715002134FD7459B20FD415453BA1E75A340B010077E40197EE4CA3C0D45C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 0680CE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae19b56b802d868afb995baccb4515a24d51455d6dd6977359c08f92c3311ab4
Instruction ID: 93b3b4e4fca267d26ee6d1ce41af0dac11ef3c2ca2e332fd7d787930fd94d6fb
Opcode Fuzzy Hash: ae19b56b802d868afb995baccb4515a24d51455d6dd6977359c08f92c3311ab4
Instruction Fuzzy Hash: 3CE092B05093D3EFDB52DB24B4449683FA0DB42100B1509BAD88097E55C67C0C45C785

Uniqueness

Uniqueness Score: -1.00%

Function 0680E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e360b2e13bc8ed89e0bdec12fdc321eef4a1223eed11fdcf3c0c9d40aa7551d
Instruction ID: 5ba9ad89c5f021bbce7c8d15f8878aaa7ba49bc83921ba51ba6136a18e3a7326
Opcode Fuzzy Hash: 9e360b2e13bc8ed89e0bdec12fdc321eef4a1223eed11fdcf3c0c9d40aa7551d
Instruction Fuzzy Hash: B9E0D871909255EFCB01CF64AC0099D7BB1DB92101B2042EBE409E3351D5340F15C751

Uniqueness

Uniqueness Score: -1.00%

Function 0680AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3411d7c23ca2dd04f75370542d46619eb624cc0e9bec998c44fcdf88fa77e68d
Instruction ID: 5eb8ed3fafc5dc57301cf42dfdc2fbcd8fca8cdb8b20704ddae7ac8fa948a18a
Opcode Fuzzy Hash: 3411d7c23ca2dd04f75370542d46619eb624cc0e9bec998c44fcdf88fa77e68d
Instruction Fuzzy Hash: 04D05EB1310129978B0967A9B4189BE7BEBEBC5672700052EE70BC3244CE755D0687E5

Uniqueness

Uniqueness Score: -1.00%

Function 0680B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13c885658a4f2897214fd7845a2dc9d5d521e0a158eacd4b65799186111c6af
Instruction ID: 204aebc810ccf305c60ecdc9e655805ba5d0920ed3642a984a7c474486e119e4
Opcode Fuzzy Hash: f13c885658a4f2897214fd7845a2dc9d5d521e0a158eacd4b65799186111c6af
Instruction Fuzzy Hash: 17E09275D0020DEFCB50DFE4E9848DDBBB9EB48201F1082AADA09A3200EB316B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0680E8F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d548e762667f1f57f2d0ae2c79b3df00c3a3ee1e02f910a69b9b2920e9fc4390
Instruction ID: 8780564fe178c1b38fddc82f4dd15a70c48a87d9e121e19bf1ce9793c37fb3bb
Opcode Fuzzy Hash: d548e762667f1f57f2d0ae2c79b3df00c3a3ee1e02f910a69b9b2920e9fc4390
Instruction Fuzzy Hash: 3AE0C739228282CFC3629F38D800821BFB0AF0320038888CAE0C0CB6B3C2208860DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0680E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2f55d3d4f83c2ba59b0deda39cd5211067b4960c5eee0b2a7ccdd7e74a02d4
Instruction ID: 49297850498c1fa92b4d16bfe5960b99b42caa21554398337db645ebc02697c7
Opcode Fuzzy Hash: 9f2f55d3d4f83c2ba59b0deda39cd5211067b4960c5eee0b2a7ccdd7e74a02d4
Instruction Fuzzy Hash: 68D05EB2A0020EFFCB40DFA8E90095DB7F9EB94205B1045BED509E3300EA352F049B90

Uniqueness

Uniqueness Score: -1.00%

Function 0680F8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a36b33f0abb722c647b4411a08351bb433128bad45603386f1b6abfd11ce50a
Instruction ID: 76bb039a917251f76a5035bcf080824288f75027d85089baf017edde5f2d3799
Opcode Fuzzy Hash: 7a36b33f0abb722c647b4411a08351bb433128bad45603386f1b6abfd11ce50a
Instruction Fuzzy Hash: 71C012367000224B0294B76C701087EA6D7A2EC1E3385003FE60EC3348CD719C478390

Uniqueness

Uniqueness Score: -1.00%

Function 0680FF6A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4681f1a2a5883a34a16873ffe3bbfca1e9f66dd6c66941a0cb4724c5d0adb817
Instruction ID: c3ab1866424e4b9a6f4832601e2478f1e176fbd73274d77b71888930ac99af54
Opcode Fuzzy Hash: 4681f1a2a5883a34a16873ffe3bbfca1e9f66dd6c66941a0cb4724c5d0adb817
Instruction Fuzzy Hash: 64C02BF238241811D200205838847BF531AC7F02A1E048037D248E86C1C82404019355

Uniqueness

Uniqueness Score: -1.00%

Function 06803723 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919b740f4419949ff2e394596d5e62cef57bfb840151586df3438ff9436f862d
Instruction ID: 5b33b7416dd78258ef654880d6fd7b0b08f47cbad3fc8a06a8be73ca594056b0
Opcode Fuzzy Hash: 919b740f4419949ff2e394596d5e62cef57bfb840151586df3438ff9436f862d
Instruction Fuzzy Hash: FFC02BF7010240A3D30226048C4AF386422E3B8743F4DC020F300C6380E7B18000B910

Uniqueness

Uniqueness Score: -1.00%

Function 0680DFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc705c1272c7b0ac7046bd8417a4e6f550fcf10e396f2239af068dca3a7c6e11
Instruction ID: 3232bc047c49b869d3b3251680a6c298b2fd96fa26dd39ad1479d57c46738165
Opcode Fuzzy Hash: cc705c1272c7b0ac7046bd8417a4e6f550fcf10e396f2239af068dca3a7c6e11
Instruction Fuzzy Hash: 01C04C25A4B3D15BEB121B34990D5147F656F53A24F2904CF968189463C5250009C791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06806FE8 Relevance: .8, Instructions: 788COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56cd3bcc027e1d54c102e33024c9a4278a9db5ca8cdbfd16d35c46230872a6f1
Instruction ID: 6daa41ea7a0c8c79a90e149c2cf0ca2f76c9ac7f497b2416e5f4e68a03902784
Opcode Fuzzy Hash: 56cd3bcc027e1d54c102e33024c9a4278a9db5ca8cdbfd16d35c46230872a6f1
Instruction Fuzzy Hash: BF6241B06102019FD748DF19C45472ABAE6EB98309F64C86CC10D9F391DFBAD94BDB91

Uniqueness

Uniqueness Score: -1.00%

Function 06806FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b8ac4a22c295c481e97479d912114362668f164d8275eb5f90c3d3ea9e66e6
Instruction ID: 0443462c581841844211fc60c417018210c71c3942b015214a669c4853b957ce
Opcode Fuzzy Hash: c9b8ac4a22c295c481e97479d912114362668f164d8275eb5f90c3d3ea9e66e6
Instruction Fuzzy Hash: 3B6241B06102019FD748DF19C45872ABAE6EB98309F64C86CC10D9F391DFBAD94BDB91

Uniqueness

Uniqueness Score: -1.00%

Function 0177DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789009970.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4ec9b17065c0c54183dd74210727ac2df1c8dbf721b261383fb8729facc2bf
Instruction ID: 8b94445e45de3256fdf3c70d240bcbb41c7df45ff8bb7079c066927e7e5b601c
Opcode Fuzzy Hash: 3e4ec9b17065c0c54183dd74210727ac2df1c8dbf721b261383fb8729facc2bf
Instruction Fuzzy Hash: 3DA17D32E002068FCF15DFB9C9445DEFBB2FF84300B25856AE915AB265DB71E956CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0680ED10 Relevance: 7.9, Strings: 6, Instructions: 372COMMON

Download Yara Rule

Strings

(_qq, xrefs: 0680EEFA
(_qq, xrefs: 0680F07A
(_qq, xrefs: 0680EF79
(_qq, xrefs: 0680F0F9
(_qq, xrefs: 0680EDF9
(_qq, xrefs: 0680ED7A

Memory Dump Source

Source File: 00000000.00000002.1806011031.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_gm5v3JlTMk.jbxd

Similarity

API ID:
String ID: (_qq$(_qq$(_qq$(_qq$(_qq$(_qq
API String ID: 0-4249418602
Opcode ID: ed8e265811930e9abedfc9494665e4123197e1bc2d1003b1c4f0cb1e2159536c
Instruction ID: 068163885def920902a89854e8f2227c01072d596099da66d5b1fd14f776983e
Opcode Fuzzy Hash: ed8e265811930e9abedfc9494665e4123197e1bc2d1003b1c4f0cb1e2159536c
Instruction Fuzzy Hash: A1D1ED78B043049FDB559F78C81456EBBB2EF96300F54886EE946DB381DA35DD06CB81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gm5v3JlTMk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gm5v3JlTMk.exe.log

C:\Users\user\AppData\Local\Temp\Tmp2B59.tmp

C:\Users\user\AppData\Local\Temp\Tmp2B6A.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
gm5v3JlTMk.exe

Function 06803F50 Relevance: 1.8, Strings: 1, Instructions: 529
COMMON

Function 067F0D80 Relevance: 20.6, Strings: 16, Instructions: 626
COMMON

Function 067F1582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Function 0177AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 01775935 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 01774248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0177C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0177D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 0177A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0177B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0177B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 067F1BA0 Relevance: 1.4, Instructions: 1445
COMMON

Function 06803DE0 Relevance: 1.4, Strings: 1, Instructions: 118
COMMON