Edit tour

Windows Analysis Report
QmFIR949GC.exe

Overview

General Information

Sample name:	QmFIR949GC.exe renamed because original name is a hash value
Original sample name:	59b981c845210902ebc9b52c47268a24.exe
Analysis ID:	1543265
MD5:	59b981c845210902ebc9b52c47268a24
SHA1:	1f3521136bced86c445a2a6654301adf78de6ebe
SHA256:	caf031a80d5d63e780b088b0f42a265d2c60896cf639fced0ea3e31f134b484d
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

QmFIR949GC.exe (PID: 3896 cmdline: "C:\Users\user\Desktop\QmFIR949GC.exe" MD5: 59B981C845210902EBC9B52C47268A24)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.92.74:7175", "Bot Id": "ZZZ", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
QmFIR949GC.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x64d8a:$v5_1: DownloadAndExecuteUpdate 0x64d7b:$v5_4: DownloadUpdate 0x650a9:$v5_5: FileScanning 0x64dcc:$v5_6: GetLenToPosState 0x64b90:$v5_7: RecordHeaderField 0x64af9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2243330330.000000000E050000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: QmFIR949GC.exe PID: 3896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QmFIR949GC.exe PID: 3896	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.QmFIR949GC.exe.a80000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x64d8a:$v5_1: DownloadAndExecuteUpdate 0x64d7b:$v5_4: DownloadUpdate 0x650a9:$v5_5: FileScanning 0x64dcc:$v5_6: GetLenToPosState 0x64b90:$v5_7: RecordHeaderField 0x64af9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.QmFIR949GC.exe.e050000.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.QmFIR949GC.exe.e050000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T14:07:00.543916+0100	2043234	1	A Network Trojan was detected	5.42.92.74	7175	192.168.2.6	49709	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T14:07:00.268236+0100	2043231	1	A Network Trojan was detected	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:05.600959+0100	2043231	1	A Network Trojan was detected	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:08.350858+0100	2043231	1	A Network Trojan was detected	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:08.664369+0100	2043231	1	A Network Trojan was detected	192.168.2.6	49709	5.42.92.74	7175	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T14:07:05.877915+0100	2046056	1	A Network Trojan was detected	5.42.92.74	7175	192.168.2.6	49709	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T14:07:00.268236+0100	2046045	1	A Network Trojan was detected	192.168.2.6	49709	5.42.92.74	7175	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.92.74:7175", "Bot Id": "ZZZ", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: QmFIR949GC.exe

ReversingLabs: Detection: 67%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QmFIR949GC.exe

Joe Sandbox ML: detected

Source: QmFIR949GC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QmFIR949GC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_0B093388
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_0B091204
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-3Ch]	0_2_0B375D08
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-3Ch]	0_2_0B3756FC
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-3Ch]	0_2_0B375DD8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then jmp 0C6C80BAh	0_2_0C6C7FD0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then jmp 0C6C80BAh	0_2_0C6C8008
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 4x nop then jmp 0C6C80BAh	0_2_0C6C8010

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49709 -> 5.42.92.74:7175
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49709 -> 5.42.92.74:7175
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 5.42.92.74:7175 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 5.42.92.74:7175 -> 192.168.2.6:49709

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.92.74:7175

Source: global traffic

TCP traffic: 192.168.2.6:49709 -> 5.42.92.74:7175

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.74

Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmH
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002FED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002FED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: QmFIR949GC.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.QmFIR949GC.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file has nameless sections

Source: QmFIR949GC.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E3DAA	0_2_014E3DAA
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E0848	0_2_014E0848
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014ECC50	0_2_014ECC50
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014EB720	0_2_014EB720
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014EF388	0_2_014EF388
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E5A60	0_2_014E5A60
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E7AE0	0_2_014E7AE0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E6289	0_2_014E6289
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E59D0	0_2_014E59D0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E9D88	0_2_014E9D88
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014EA000	0_2_014EA000
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E081F	0_2_014E081F
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E94C0	0_2_014E94C0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E88F8	0_2_014E88F8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E9B48	0_2_014E9B48
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E079F	0_2_014E079F
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E4EE9	0_2_014E4EE9
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_014E4EF8	0_2_014E4EF8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E40270	0_2_02E40270
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E410FB	0_2_02E410FB
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E44C08	0_2_02E44C08
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E43260	0_2_02E43260
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E40268	0_2_02E40268
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E43257	0_2_02E43257
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E436F0	0_2_02E436F0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E436F8	0_2_02E436F8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E43480	0_2_02E43480
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E43477	0_2_02E43477
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E4E5CC	0_2_02E4E5CC
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E42B88	0_2_02E42B88
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E42B7F	0_2_02E42B7F
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E42EA0	0_2_02E42EA0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E42E98	0_2_02E42E98
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_02E44C00	0_2_02E44C00
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053AF010	0_2_053AF010
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A9D78	0_2_053A9D78
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A0418	0_2_053A0418
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A040A	0_2_053A040A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A03D0	0_2_053A03D0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A0FB0	0_2_053A0FB0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A0FC0	0_2_053A0FC0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A12C8	0_2_053A12C8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A1D30	0_2_053A1D30
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A1D21	0_2_053A1D21
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A18A0	0_2_053A18A0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A1890	0_2_053A1890
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A1B18	0_2_053A1B18
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_053A1B0A	0_2_053A1B0A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B098D40	0_2_0B098D40
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B09A060	0_2_0B09A060
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B097318	0_2_0B097318
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B09807A	0_2_0B09807A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B090709	0_2_0B090709
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B090710	0_2_0B090710
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B098760	0_2_0B098760
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B371130	0_2_0B371130
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B371122	0_2_0B371122
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B376760	0_2_0B376760
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B39AA80	0_2_0B39AA80
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B39D838	0_2_0B39D838
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B396240	0_2_0B396240
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B39AA80	0_2_0B39AA80
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B39AA80	0_2_0B39AA80
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3C0040	0_2_0B3C0040
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3C164C	0_2_0B3C164C
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D73E8	0_2_0B3D73E8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D59D0	0_2_0B3D59D0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DC000	0_2_0B3DC000
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D0040	0_2_0B3D0040
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DF898	0_2_0B3DF898
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D2F40	0_2_0B3D2F40
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DDE00	0_2_0B3DDE00
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DE6D8	0_2_0B3DE6D8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DADD0	0_2_0B3DADD0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D7398	0_2_0B3D7398
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D59C6	0_2_0B3D59C6
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D3840	0_2_0B3D3840
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DF88A	0_2_0B3DF88A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DA880	0_2_0B3DA880
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D2F30	0_2_0B3D2F30
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D77A3	0_2_0B3D77A3
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D779A	0_2_0B3D779A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D7785	0_2_0B3D7785
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D7661	0_2_0B3D7661
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DE6C9	0_2_0B3DE6C9
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D2564	0_2_0B3D2564
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3DDDF1	0_2_0B3DDDF1
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D6410	0_2_0B3D6410
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D6402	0_2_0B3D6402
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D2463	0_2_0B3D2463
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3D24F0	0_2_0B3D24F0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C6C10	0_2_0C6C6C10
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C78D8	0_2_0C6C78D8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C9098	0_2_0C6C9098
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CF388	0_2_0C6CF388
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C6C00	0_2_0C6C6C00
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CD4A8	0_2_0C6CD4A8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CED90	0_2_0C6CED90
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CF770	0_2_0C6CF770
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CAF28	0_2_0C6CAF28
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C2FA3	0_2_0C6C2FA3
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C2FB0	0_2_0C6C2FB0
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C7078	0_2_0C6C7078
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C78C9	0_2_0C6C78C9
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CE8A8	0_2_0C6CE8A8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C7088	0_2_0C6C7088
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C9088	0_2_0C6C9088
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C9096	0_2_0C6C9096
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C4940	0_2_0C6C4940
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C4950	0_2_0C6C4950
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CC238	0_2_0C6CC238
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C128A	0_2_0C6C128A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CEB70	0_2_0C6CEB70
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6CE358	0_2_0C6CE358
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C3308	0_2_0C6C3308
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C3318	0_2_0C6C3318
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D2EA8	0_2_0C6D2EA8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D6802	0_2_0C6D6802
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D7558	0_2_0C6D7558
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D4508	0_2_0C6D4508
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D0040	0_2_0C6D0040
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6DC1E2	0_2_0C6DC1E2
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D51C8	0_2_0C6D51C8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D3268	0_2_0C6D3268
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D2E98	0_2_0C6D2E98
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D09EF	0_2_0C6D09EF
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D3B35	0_2_0C6D3B35
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D2536	0_2_0C6D2536
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D4508	0_2_0C6D4508
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D8638	0_2_0C6D8638
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D2727	0_2_0C6D2727
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D0007	0_2_0C6D0007
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D51B8	0_2_0C6D51B8
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D326A	0_2_0C6D326A
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D5387	0_2_0C6D5387

Source: QmFIR949GC.exe, 00000000.00000000.2117543917.0000000000B04000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs QmFIR949GC.exe
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs QmFIR949GC.exe
Source: QmFIR949GC.exe, 00000000.00000002.2243330330.000000000E0CF000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs QmFIR949GC.exe
Source: QmFIR949GC.exe, 00000000.00000002.2223767670.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QmFIR949GC.exe
Source: QmFIR949GC.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs QmFIR949GC.exe

Source: QmFIR949GC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QmFIR949GC.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.QmFIR949GC.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: QmFIR949GC.exe

Static PE information: Section: B8pD.MV ZLIB complexity 1.0003327170026008

Source: QmFIR949GC.exe, 00000000.00000002.2240302795.000000000B9CF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: owsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBPY

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\QmFIR949GC.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Mutant created: NULL

Source: QmFIR949GC.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000047EF000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004A3F000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2227754613.000000000481E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QmFIR949GC.exe

ReversingLabs: Detection: 67%

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: QmFIR949GC.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QmFIR949GC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Unpacked PE file: 0.2.QmFIR949GC.exe.a80000.0.unpack B8pD.MV:EW;.text:ER;.rsrc:R;Unknown_Section3:ER;.reloc:R; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:ER;Unknown_Section4:R;

Source: QmFIR949GC.exe	Static PE information: section name: B8pD.MV
Source: QmFIR949GC.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_00ADCA37 push es; retf	0_2_00ADCA41
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_00ADF35C push ecx; iretd	0_2_00ADF35D
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B374DB1 push cs; ret	0_2_0B374E24
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0B3742D7 push ebx; ret	0_2_0B3742DA
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C1190 push eax; retf	0_2_0C6C11A9
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C522F push ecx; iretd	0_2_0C6C5230
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6C5225 push ecx; iretd	0_2_0C6C5226
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Code function: 0_2_0C6D12A6 push dword ptr [edi-2Dh]; retf	0_2_0C6D12B7

Source: QmFIR949GC.exe

Static PE information: section name: B8pD.MV entropy: 7.9995056962342534

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\QmFIR949GC.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\QmFIR949GC.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 14A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 5500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 6500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 6630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 7630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 7980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 8980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 9980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: ABC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: BBC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: C050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: D050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 5500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 6630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 7980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 8980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Memory allocated: 9980000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Window / User API: threadDelayed 845			Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Window / User API: threadDelayed 2127			Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe TID: 2268	Thread sleep time: -10145709240540247s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe TID: 1268	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004972000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: QmFIR949GC.exe, 00000000.00000002.2236823805.000000000AE50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.000000000312D000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.000000000338D000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.0000000003067000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: QmFIR949GC.exe, 00000000.00000002.2225036439.0000000003209000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztb
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: QmFIR949GC.exe	Binary or memory string: VmCI5l
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.00000000048CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: QmFIR949GC.exe, 00000000.00000002.2227754613.0000000003F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Code function: 0_2_0140D1C4 LdrInitializeThunk,

0_2_0140D1C4

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Users\user\Desktop\QmFIR949GC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\QmFIR949GC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.QmFIR949GC.exe.e050000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QmFIR949GC.exe.e050000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2243330330.000000000E050000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QmFIR949GC.exe PID: 3896, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\QmFIR949GC.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QmFIR949GC.exe PID: 3896, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.QmFIR949GC.exe.e050000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QmFIR949GC.exe.e050000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2243330330.000000000E050000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QmFIR949GC.exe PID: 3896, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QmFIR949GC.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineSteal
QmFIR949GC.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.42.92.74:7175	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002FED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	QmFIR949GC.exe, 00000000.00000002.2227754613.0000000004734000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002FED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23Response	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/D	QmFIR949GC.exe, 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.92.74	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543265
Start date and time:	2024-10-27 14:06:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QmFIR949GC.exe renamed because original name is a hash value
Original Sample Name:	59b981c845210902ebc9b52c47268a24.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 308 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ocsp.edge.digicert.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: QmFIR949GC.exe

Simulations

Behavior and APIs

Time	Type	Description
09:07:06	API Interceptor	16x Sleep call for process: QmFIR949GC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.42.92.74	CFYd8cbC6L.exe	Get hash	malicious	RedLine	Browse
	AdmalRLZI0.exe	Get hash	malicious	RedLine	Browse
	SecuriteInfo.com.Win32.Evo-gen.25810.23454.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	173003262782b8017037917b9961fbcad57f6b662e24836f7d97dbd52e59bb21507b98d9a6704.dat-decoded.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	1730032629d03288421fce5e7d9e6026f5a967d50c541a02112bcbceaac1a2fa9677728cde553.dat-decoded.exe	Get hash	malicious	Blackshades	Browse	192.229.221.95
	v9dVG4fAGa.exe	Get hash	malicious	Clipboard Hijacker	Browse	192.229.221.95
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	192.229.221.95
	https://link.edgepilot.com/s/e9b35021/KNsrNVGwOUukNjaKm_560w?u=https://publicidadnicaragua.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	fd5P4igezR.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	http://cio.krqe.com/gtdhffgjghfj3081868fB16927453Xe78849729yB17367Xb25vBr206268IG	Get hash	malicious	Unknown	Browse	192.229.221.95
	loader.exe	Get hash	malicious	DCRat	Browse	192.229.221.95
	uIBGhwqEUB.ps1	Get hash	malicious	Meterpreter	Browse	192.229.221.95
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	CFYd8cbC6L.exe	Get hash	malicious	RedLine	Browse	5.42.92.74
	AdmalRLZI0.exe	Get hash	malicious	RedLine	Browse	5.42.92.74
	SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe	Get hash	malicious	Unknown	Browse	5.42.66.119
	b2smJKgMG6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	5.42.92.37
	Payment Advicegpj..exe	Get hash	malicious	Unknown	Browse	5.42.94.169
	Payment Advicegpj..exe	Get hash	malicious	Unknown	Browse	5.42.94.169
	SecuriteInfo.com.Win32.Evo-gen.25810.23454.exe	Get hash	malicious	XWorm	Browse	5.42.92.74
	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	5.42.66.51
	na.elf	Get hash	malicious	Mirai, Gafgyt	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74

Process:	C:\Users\user\Desktop\QmFIR949GC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3ou0aymCtI6eqzxTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3n0atCtI6eqzxTqdqlq7qV
MD5:	2A7E8E945D2BA34CC3496A61B09B9E7B
SHA1:	572BC2EC6FC4FDC67C6B9BADDF750657C7E49F40
SHA-256:	2DD73A7593A9C11E0572FB5C1651A68D426058183E21ED0612B34D2977B278AC
SHA-512:	63AD87DC9DFC8F525480ACA655246A8CC39FC4EDF267F38076BBB86FFCD48E7535F213EEF609FDF2DA97B7D8095A3DC89EFF800E20F095228A427BADE34CED65
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\Presen

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.230915266768685
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	QmFIR949GC.exe
File size:	555'520 bytes
MD5:	59b981c845210902ebc9b52c47268a24
SHA1:	1f3521136bced86c445a2a6654301adf78de6ebe
SHA256:	caf031a80d5d63e780b088b0f42a265d2c60896cf639fced0ea3e31f134b484d
SHA512:	a3f1ea46edb62e8795bdd9d6c19febf6ff8794c32bd20ca0e6e1011de366ef1f203f8f6eda4776561422c64de92e927b23faeeba35cc260807bc6b9e9c5d3b6e
SSDEEP:	12288:+eqiMtLByk5KnXTdJd3tc6Q+g6c0NOUAeTSQyvug2W078:JqbNF5KDHdC6RrxNOxeT
TLSH:	1FC4F09C7260319EC417C5719EA5EDB0A7206CA6435B8203A9E33EAFBD1C953CF615F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................................@... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x48e00a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x671A2EB7 [Thu Oct 24 11:25:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [0048E000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x66220	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x90000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8e000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x64000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
B8pD.MV	0x2000	0x60148	0x60200	91e97221ed0500e9b57a5cc40efe8727	False	1.0003327170026008	data	7.9995056962342534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x64000	0xa408	0xa600	8f33ded67c86559df23a198dca847871	False	0.4660438629518072	data	5.813652314482949	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1c9c6	0x1ca00	151f715c08178f763603a0a32b03496b	False	0.2380850846069869	data	2.6150513704329854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x8e000	0x10	0x200	bc04a0598183ea9bb25ac8939e49c464	False	0.044921875	data	0.14263576814887827	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x90000	0xc	0x200	a40069bf8b25090b384bf1696beeb86c	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x70220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x73f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x8474c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x88974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x8af1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x8bfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x8c42c	0x5a	data	0.7666666666666667
RT_VERSION	0x8c488	0x352	data	0.4447058823529412
RT_MANIFEST	0x8c7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T14:07:00.268236+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:00.268236+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:00.543916+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	5.42.92.74	7175	192.168.2.6	49709	TCP
2024-10-27T14:07:05.600959+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:05.877915+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	5.42.92.74	7175	192.168.2.6	49709	TCP
2024-10-27T14:07:08.350858+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49709	5.42.92.74	7175	TCP
2024-10-27T14:07:08.664369+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49709	5.42.92.74	7175	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 14:06:59.328779936 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:06:59.334484100 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:06:59.334882975 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:06:59.344114065 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:06:59.349656105 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:00.232265949 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:00.268235922 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:00.273747921 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:00.543915987 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:00.595660925 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:05.600959063 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:05.606455088 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:05.877805948 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:05.877830982 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:05.877842903 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:05.877902031 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:05.877906084 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:05.877914906 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:05.877955914 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:05.923755884 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.155553102 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.160952091 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161010027 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.161055088 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161066055 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161097050 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161106110 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161112070 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161115885 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161122084 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.161155939 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.161191940 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.161215067 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161225080 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161233902 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.161283970 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166490078 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166548967 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166587114 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166598082 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166619062 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166626930 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166630030 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166640043 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166656971 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166686058 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166696072 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166727066 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166740894 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166754961 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166774035 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166798115 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166801929 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166809082 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166855097 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166866064 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166903973 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.166907072 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.166949034 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.172435045 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.172492981 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.172549009 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.172609091 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.172614098 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.172647953 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.172662020 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.172705889 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173410892 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173423052 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173434973 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173476934 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173506021 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173512936 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173526049 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173556089 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173566103 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173568010 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173595905 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173597097 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173608065 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173609972 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173641920 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173650980 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173660040 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173690081 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173700094 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173722982 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173758984 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173758984 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173770905 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173780918 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173814058 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173824072 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173825026 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173834085 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173856020 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173856974 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173866034 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173882961 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173903942 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173913956 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173914909 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173926115 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.173949957 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.173965931 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.177926064 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.177937031 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.177946091 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.177963972 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.177973986 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.177983046 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178021908 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178034067 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178040028 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178042889 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178071976 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178108931 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178114891 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178117990 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178127050 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178134918 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178143978 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178148031 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178150892 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178152084 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178165913 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178174973 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178179026 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.178881884 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178890944 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178899050 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.178909063 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179176092 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179184914 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179224968 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179234028 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179241896 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179250956 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179260015 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179269075 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179277897 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179281950 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179286003 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179327011 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179344893 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179357052 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179366112 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179374933 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179384947 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179394007 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179403067 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179538012 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179548025 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179554939 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179584980 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.179615974 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179626942 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179635048 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179644108 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179652929 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179665089 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179671049 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.179676056 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179689884 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179703951 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179714918 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179724932 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179735899 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179758072 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179774046 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179785967 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179796934 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179809093 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179821968 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179835081 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179847002 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179858923 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179871082 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179883957 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179912090 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179924965 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179938078 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179949999 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.179963112 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183509111 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183521986 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183584929 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183597088 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183607101 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183643103 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183655024 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183666945 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183691025 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183702946 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183723927 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183736086 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.183749914 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184225082 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184237957 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184246063 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184269905 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184344053 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184353113 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184360981 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.184603930 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.184689999 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.185267925 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185276985 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185327053 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185334921 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185343027 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185376883 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185452938 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185507059 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185516119 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185570002 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185606956 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185720921 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185729980 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185753107 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185760975 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185831070 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185841084 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185857058 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185867071 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185908079 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185918093 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185934067 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185942888 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185980082 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.185988903 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186048985 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186058044 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186134100 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186144114 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186178923 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186188936 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186212063 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186220884 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186235905 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186245918 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186284065 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186292887 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186309099 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186319113 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186336994 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186346054 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186362982 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186372995 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186383009 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186440945 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186475992 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186486006 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186517000 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186527014 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186547995 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186557055 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186635017 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.186645031 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190094948 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190114021 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190174103 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190184116 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190222025 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190236092 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190248966 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190262079 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190283060 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190294981 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190298080 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.190310001 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190332890 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190375090 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.190386057 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190397978 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190426111 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190437078 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190504074 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190512896 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190531969 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190541029 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190610886 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190620899 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190632105 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190651894 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190664053 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190674067 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190745115 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190754890 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190763950 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190773010 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190783024 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190793037 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190809965 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190819979 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190824032 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190834045 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190839052 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190850019 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190871000 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190881968 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190901041 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190912962 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190934896 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190943956 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190959930 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.190970898 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191030025 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191039085 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191056013 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191065073 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191072941 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191082001 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.191127062 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195691109 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195774078 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195785046 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195832014 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195842028 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195894957 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195907116 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195935965 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195946932 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195966959 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195976973 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.195998907 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196010113 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196018934 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.196038961 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196049929 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196098089 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196101904 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.196110964 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196121931 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196131945 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196147919 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196160078 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196178913 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196190119 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196219921 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196230888 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196240902 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196254015 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196271896 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196285009 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196296930 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196310043 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196329117 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196337938 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196423054 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196434021 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196444988 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196458101 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196480036 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196492910 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196513891 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196523905 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196540117 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196549892 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196583986 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196593046 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196615934 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196624994 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196681023 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196690083 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196733952 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196830988 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.196840048 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.197005033 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201535940 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201558113 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201603889 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201656103 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201664925 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201673031 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201715946 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201726913 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201777935 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.201837063 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201848984 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201858044 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201860905 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.201893091 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201901913 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201924086 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201936007 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201952934 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201962948 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.201973915 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202038050 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202047110 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202055931 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202075958 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202086926 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202102900 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202112913 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202183008 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202199936 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202208996 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202218056 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202235937 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202246904 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202256918 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202265978 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202284098 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202287912 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202363014 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202373981 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202383995 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202394962 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202424049 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202435017 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202461958 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202471972 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202554941 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202565908 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202577114 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202599049 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202610970 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202621937 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202634096 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202651024 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202661991 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.202673912 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207254887 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207268000 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207276106 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207285881 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207303047 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207319975 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207336903 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207348108 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207365990 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207376003 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207385063 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207403898 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207412958 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207470894 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207480907 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207489014 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207498074 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207515955 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207525969 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207540035 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.207542896 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207551956 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207597017 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207606077 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207618952 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.207623005 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207633018 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207663059 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207672119 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207695961 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207705021 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207735062 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207743883 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207792997 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207803011 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207818985 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207828999 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207853079 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.207863092 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.220608950 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.226177931 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.226404905 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.226511002 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.226511002 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.226563931 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.231853962 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231869936 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231889009 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231899023 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231906891 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231923103 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231933117 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231941938 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.231962919 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.232043028 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.232053041 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.232062101 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.232069969 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.232088089 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.232096910 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:07.267504930 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:07.272969961 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:08.349550962 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:08.350857973 CET	49709	7175	192.168.2.6	5.42.92.74
Oct 27, 2024 14:07:08.356350899 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:08.626756907 CET	7175	49709	5.42.92.74	192.168.2.6
Oct 27, 2024 14:07:08.664369106 CET	49709	7175	192.168.2.6	5.42.92.74

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 14:07:15.453942060 CET	1.1.1.1	192.168.2.6	0xa747	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 14:07:15.453942060 CET	1.1.1.1	192.168.2.6	0xa747	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:06:57
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\QmFIR949GC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QmFIR949GC.exe"
Imagebase:	0xa80000
File size:	555'520 bytes
MD5 hash:	59B981C845210902EBC9B52C47268A24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2243330330.000000000E050000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2225036439.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QmFIR949GC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QmFIR949GC.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
QmFIR949GC.exe