Edit tour

Windows Analysis Report
3WSFIhTu1M.exe

Overview

General Information

Sample name:	3WSFIhTu1M.exe renamed because original name is a hash value
Original sample name:	5c7dfeaaab049b0c4a2b6fe06c7d6d8d54202ab9b5ba637b73faa01bccb5debc.exe
Analysis ID:	1609372
MD5:	5a0a07ed263bd6f1a77c46efedcfa907
SHA1:	67f906d51dd2fa5975d9d21fb3874c950d32a11c
SHA256:	5c7dfeaaab049b0c4a2b6fe06c7d6d8d54202ab9b5ba637b73faa01bccb5debc
Tags:	exeuser-adrian__luca
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Potential key logger detected (key state polling based)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

3WSFIhTu1M.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\3WSFIhTu1M.exe" MD5: 5A0A07ED263BD6F1A77C46EFEDCFA907)

powershell.exe (PID: 7808 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7972 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 8020 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

3WSFIhTu1M.exe (PID: 8072 cmdline: "C:\Users\user\Desktop\3WSFIhTu1M.exe" MD5: 5A0A07ED263BD6F1A77C46EFEDCFA907)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rBRzAEam.exe (PID: 8092 cmdline: C:\Users\user\AppData\Roaming\rBRzAEam.exe MD5: 5A0A07ED263BD6F1A77C46EFEDCFA907)

schtasks.exe (PID: 7300 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rBRzAEam.exe (PID: 2056 cmdline: "C:\Users\user\AppData\Roaming\rBRzAEam.exe" MD5: 5A0A07ED263BD6F1A77C46EFEDCFA907)

conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.222.58.254:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1375a:$a4: get_ScannedWallets 0x125b8:$a5: get_ScanTelegram 0x133de:$a6: get_ScanGeckoBrowsersPaths 0x111fa:$a7: <Processes>k__BackingField 0xf10c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10b2e:$a9: <ScanFTP>k__BackingField
00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1369a:$a4: get_ScannedWallets 0x2b4ba:$a4: get_ScannedWallets 0x124f8:$a5: get_ScanTelegram 0x2a318:$a5: get_ScanTelegram 0x1331e:$a6: get_ScanGeckoBrowsersPaths 0x2b13e:$a6: get_ScanGeckoBrowsersPaths 0x1113a:$a7: <Processes>k__BackingField 0x28f5a:$a7: <Processes>k__BackingField 0xf04c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26e6c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10a6e:$a9: <ScanFTP>k__BackingField 0x2888e:$a9: <ScanFTP>k__BackingField
0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x14482:$a4: get_ScannedWallets 0x2c2a2:$a4: get_ScannedWallets 0x43ec2:$a4: get_ScannedWallets 0x132e0:$a5: get_ScanTelegram 0x2b100:$a5: get_ScanTelegram 0x42d20:$a5: get_ScanTelegram 0x14106:$a6: get_ScanGeckoBrowsersPaths 0x2bf26:$a6: get_ScanGeckoBrowsersPaths 0x43b46:$a6: get_ScanGeckoBrowsersPaths 0x11f22:$a7: <Processes>k__BackingField 0x29d42:$a7: <Processes>k__BackingField 0x41962:$a7: <Processes>k__BackingField 0xfe34:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x27c54:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f874:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11856:$a9: <ScanFTP>k__BackingField 0x29676:$a9: <ScanFTP>k__BackingField 0x41296:$a9: <ScanFTP>k__BackingField
Process Memory Space: 3WSFIhTu1M.exe PID: 7528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3WSFIhTu1M.exe PID: 7528	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 3WSFIhTu1M.exe PID: 7528	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 3WSFIhTu1M.exe PID: 7528	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x2ebcb:$a4: get_ScannedWallets 0x5fbdc:$a4: get_ScannedWallets 0x2da72:$a5: get_ScanTelegram 0x5ea83:$a5: get_ScanTelegram 0x2e854:$a6: get_ScanGeckoBrowsersPaths 0x5f865:$a6: get_ScanGeckoBrowsersPaths 0x2c705:$a7: <Processes>k__BackingField 0x5d716:$a7: <Processes>k__BackingField 0x29c38:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5ac49:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x2c039:$a9: <ScanFTP>k__BackingField 0x5d04a:$a9: <ScanFTP>k__BackingField
Process Memory Space: 3WSFIhTu1M.exe PID: 8072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3WSFIhTu1M.exe PID: 8072	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 3WSFIhTu1M.exe PID: 8072	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x447233:$a4: get_ScannedWallets 0x4460da:$a5: get_ScanTelegram 0x446ebc:$a6: get_ScanGeckoBrowsersPaths 0x444d6d:$a7: <Processes>k__BackingField 0x4422a0:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x4446a1:$a9: <ScanFTP>k__BackingField
Process Memory Space: rBRzAEam.exe PID: 8092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rBRzAEam.exe PID: 8092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: rBRzAEam.exe PID: 8092	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: rBRzAEam.exe PID: 8092	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x22ef2:$a4: get_ScannedWallets 0x21d99:$a5: get_ScanTelegram 0x22b7b:$a6: get_ScanGeckoBrowsersPaths 0x20a2c:$a7: <Processes>k__BackingField 0x1df5f:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x20360:$a9: <ScanFTP>k__BackingField
Process Memory Space: rBRzAEam.exe PID: 2056	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rBRzAEam.exe PID: 2056	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.rBRzAEam.exe.4badcd8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.rBRzAEam.exe.4badcd8.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.rBRzAEam.exe.4badcd8.2.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.rBRzAEam.exe.4badcd8.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bf:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
10.2.rBRzAEam.exe.4badcd8.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bf:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
8.2.3WSFIhTu1M.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.3WSFIhTu1M.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
8.2.3WSFIhTu1M.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
8.2.3WSFIhTu1M.exe.400000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
8.2.3WSFIhTu1M.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
10.2.rBRzAEam.exe.4b95eb8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.rBRzAEam.exe.4b95eb8.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.rBRzAEam.exe.4b95eb8.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.rBRzAEam.exe.4b95eb8.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bf:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
10.2.rBRzAEam.exe.4b95eb8.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
0.2.3WSFIhTu1M.exe.459a0d0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3WSFIhTu1M.exe.459a0d0.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.3WSFIhTu1M.exe.459a0d0.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.3WSFIhTu1M.exe.459a0d0.3.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bf:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.3WSFIhTu1M.exe.459a0d0.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
10.2.rBRzAEam.exe.4badcd8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.rBRzAEam.exe.4badcd8.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.rBRzAEam.exe.4badcd8.2.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
10.2.rBRzAEam.exe.4badcd8.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x295eb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x2961f:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x29648:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x2b887:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x2ae03:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x2b14b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x2aa81:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x2826f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x20358:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x20d38:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet
10.2.rBRzAEam.exe.4badcd8.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField
0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x297eb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x2981f:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x29848:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x2ba87:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x2b003:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x2b34b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x2ac81:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x2846f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x20558:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x20f38:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet
0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x284ab:$v2_2: get_ScanVPN 0x2854e:$v2_2: get_ScanFTP
10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x297eb:$gen01: ChromeGetRoamingName 0x4140b:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x2981f:$gen02: ChromeGetLocalName 0x4143f:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x29848:$gen03: get_UserDomainName 0x41468:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x2ba87:$gen04: get_encrypted_key 0x436a7:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x2b003:$gen05: browserPaths 0x42c23:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x2b34b:$gen06: GetBrowsers 0x42f6b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x2ac81:$gen07: get_InstalledInputLanguages 0x428a1:$gen07: get_InstalledInputLanguages
10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
Click to see the 40 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3WSFIhTu1M.exe", ParentImage: C:\Users\user\Desktop\3WSFIhTu1M.exe, ParentProcessId: 7528, ParentProcessName: 3WSFIhTu1M.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe", ProcessId: 7808, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\rBRzAEam.exe, ParentImage: C:\Users\user\AppData\Roaming\rBRzAEam.exe, ParentProcessId: 8092, ParentProcessName: rBRzAEam.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp", ProcessId: 7300, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\3WSFIhTu1M.exe", ParentImage: C:\Users\user\Desktop\3WSFIhTu1M.exe, ParentProcessId: 7528, ParentProcessName: 3WSFIhTu1M.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp", ProcessId: 8020, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3WSFIhTu1M.exe", ParentImage: C:\Users\user\Desktop\3WSFIhTu1M.exe, ParentProcessId: 7528, ParentProcessName: 3WSFIhTu1M.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe", ProcessId: 7808, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\3WSFIhTu1M.exe", ParentImage: C:\Users\user\Desktop\3WSFIhTu1M.exe, ParentProcessId: 7528, ParentProcessName: 3WSFIhTu1M.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp", ProcessId: 8020, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:39.250288+0100	2045000	1	Malware Command and Control Activity Detected	185.222.58.254	55615	192.168.2.8	49712	TCP
2025-02-07T16:54:46.132163+0100	2045000	1	Malware Command and Control Activity Detected	185.222.58.254	55615	192.168.2.8	49718	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:42.914369+0100	2046056	1	A Network Trojan was detected	185.222.58.254	55615	192.168.2.8	49712	TCP
2025-02-07T16:54:50.212932+0100	2046056	1	A Network Trojan was detected	185.222.58.254	55615	192.168.2.8	49718	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:42.914369+0100	2045001	1	Malware Command and Control Activity Detected	185.222.58.254	55615	192.168.2.8	49712	TCP
2025-02-07T16:54:50.212932+0100	2045001	1	Malware Command and Control Activity Detected	185.222.58.254	55615	192.168.2.8	49718	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:34.090777+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49712	185.222.58.254	55615	TCP
2025-02-07T16:54:40.981440+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49718	185.222.58.254	55615	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:39.673308+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.8	49712	185.222.58.254	55615	TCP
2025-02-07T16:54:46.578909+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.8	49718	185.222.58.254	55615	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:44.943232+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.8	63616	185.222.58.254	55615	TCP
2025-02-07T16:54:52.207818+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.8	63619	185.222.58.254	55615	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:43.316865+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.8	63615	185.222.58.254	55615	TCP
2025-02-07T16:54:50.611255+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.8	63618	185.222.58.254	55615	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T16:54:34.090777+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49712	185.222.58.254	55615	TCP
2025-02-07T16:54:40.981440+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49718	185.222.58.254	55615	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["185.222.58.254:55615"], "Bot Id": "cheat"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: 3WSFIhTu1M.exe	ReversingLabs: Detection: 63%
Source: 3WSFIhTu1M.exe	Virustotal: Detection: 61%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 3WSFIhTu1M.exe

Joe Sandbox ML: detected

Source: 3WSFIhTu1M.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.8:49717 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.8:63617 version: TLS 1.0

Source: 3WSFIhTu1M.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: XuOX.pdb source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr
Source:	Binary string: XuOX.pdbSHA256R source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 4x nop then jmp 04AE8D06h		0_2_04AE9623
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 4x nop then jmp 05D1C227h		10_2_05D1CB44

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49712 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49712 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.8:63615 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.8:63616 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.8:63618 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 185.222.58.254:55615 -> 192.168.2.8:49712
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.8:49712 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.8:63619 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49718 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49718 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 185.222.58.254:55615 -> 192.168.2.8:49712
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.222.58.254:55615 -> 192.168.2.8:49712
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 185.222.58.254:55615 -> 192.168.2.8:49718
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.8:49718 -> 185.222.58.254:55615
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 185.222.58.254:55615 -> 192.168.2.8:49718
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.222.58.254:55615 -> 192.168.2.8:49718

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.222.58.254:55615

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 63615 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63615
Source: unknown	Network traffic detected: HTTP traffic on port 63616 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63616
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 63618 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63618
Source: unknown	Network traffic detected: HTTP traffic on port 63619 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63619

Source: global traffic

TCP traffic: 192.168.2.8:49712 -> 185.222.58.254:55615

Source: global traffic

TCP traffic: 192.168.2.8:63614 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.254:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.254:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.254:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.254:55615Content-Length: 927086Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.254:55615Content-Length: 927078Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.254:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.254:55615Content-Length: 926569Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.254:55615Content-Length: 926561Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.26.13.31 104.26.13.31

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.8:49717 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.8:63617 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.254

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.254:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000033FC000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.254:55615
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.254:55615/
Source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1628477749.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	String found in binary or memory: http://tempuri.org/DatabaseCore.xsd
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: rBRzAEam.exe, 0000000E.00000002.1742446790.00000000033FC000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 3WSFIhTu1M.exe, 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 3WSFIhTu1M.exe	String found in binary or memory: https://api.ipify.orgcoo
Source: 3WSFIhTu1M.exe, 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 3WSFIhTu1M.exe, 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 63617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Code function: 0_2_04AE2B30 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_04AE2B30

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: 3WSFIhTu1M.exe PID: 7528, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: 3WSFIhTu1M.exe PID: 8072, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: rBRzAEam.exe PID: 8092, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0292E02C	0_2_0292E02C
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_04AE7090	0_2_04AE7090
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076A02A0	0_2_076A02A0
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076A6910	0_2_076A6910
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076A6900	0_2_076A6900
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B6768	0_2_076B6768
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B0128	0_2_076B0128
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076BE1A6	0_2_076BE1A6
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B4048	0_2_076B4048
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B40EB	0_2_076B40EB
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B7420	0_2_076B7420
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B03FA	0_2_076B03FA
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B93C1	0_2_076B93C1
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B93D0	0_2_076B93D0
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B0118	0_2_076B0118
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B4037	0_2_076B4037
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B6FE8	0_2_076B6FE8
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B6FBF	0_2_076B6FBF
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B7C80	0_2_076B7C80
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B7C90	0_2_076B7C90
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076BAB88	0_2_076BAB88
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B7849	0_2_076B7849
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B7858	0_2_076B7858
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_07A0BEA0	0_2_07A0BEA0
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_07A0D171	0_2_07A0D171
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_07A0F7B2	0_2_07A0F7B2
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBCB550	0_2_0EBCB550
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBCF380	0_2_0EBCF380
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBC68A8	0_2_0EBC68A8
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBC316C	0_2_0EBC316C
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBCB550	0_2_0EBCB550
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBCF380	0_2_0EBCF380
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0EBCC1D6	0_2_0EBCC1D6
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_0277E7B0	8_2_0277E7B0
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_0277DC90	8_2_0277DC90
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_06299630	8_2_06299630
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_06293720	8_2_06293720
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_06294468	8_2_06294468
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_06291210	8_2_06291210
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_0629D140	8_2_0629D140
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_0629DA30	8_2_0629DA30
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D50648	8_2_07D50648
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D56040	8_2_07D56040
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D57F57	8_2_07D57F57
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D57F68	8_2_07D57F68
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D55958	8_2_07D55958
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D7D6C0	8_2_07D7D6C0
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D7E938	8_2_07D7E938
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D76FF8	8_2_07D76FF8
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D76FE8	8_2_07D76FE8
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D76868	8_2_07D76868
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_0306E02C	10_2_0306E02C
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D1E0B8	10_2_05D1E0B8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D10408	10_2_05D10408
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D17420	10_2_05D17420
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D10118	10_2_05D10118
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D10128	10_2_05D10128
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D193D0	10_2_05D193D0
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D193CF	10_2_05D193CF
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D103FB	10_2_05D103FB
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D17C90	10_2_05D17C90
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D17C80	10_2_05D17C80
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D16FE8	10_2_05D16FE8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D17857	10_2_05D17857
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D17858	10_2_05D17858
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_056BE7B0	14_2_056BE7B0
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_056BDC90	14_2_056BDC90
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B59630	14_2_06B59630
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B53711	14_2_06B53711
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B54468	14_2_06B54468
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B51210	14_2_06B51210
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B5DD18	14_2_06B5DD18
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B5DA24	14_2_06B5DA24
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B5D528	14_2_06B5D528
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B5EAA8	14_2_06B5EAA8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_06B5EA98	14_2_06B5EA98
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0757E750	14_2_0757E750
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0757DA40	14_2_0757DA40
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0757F0E8	14_2_0757F0E8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_07578D78	14_2_07578D78
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_07576C20	14_2_07576C20
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0757B4C8	14_2_0757B4C8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_075724B8	14_2_075724B8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_07575310	14_2_07575310
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_07578258	14_2_07578258
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0757D2D0	14_2_0757D2D0
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_08614E90	14_2_08614E90
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_08614778	14_2_08614778
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_086157C8	14_2_086157C8
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0861A930	14_2_0861A930
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_08616938	14_2_08616938
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0861A91F	14_2_0861A91F
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 14_2_0861467F	14_2_0861467F

Source: 3WSFIhTu1M.exe

Static PE information: invalid certificate

Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorlib.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXuOX.exe" vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Drawing.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Core.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Configuration.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Xml.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.DLLT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000000.1425803406.00000000007E4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXuOX.exe" vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1547800248.00000000078E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1535237130.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1547426077.00000000076C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.0000000004323000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\080904B0\\OriginalFilename vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe, 00000008.00000002.1668575367.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 3WSFIhTu1M.exe
Source: 3WSFIhTu1M.exe	Binary or memory string: OriginalFilenameXuOX.exe" vs 3WSFIhTu1M.exe

Source: 3WSFIhTu1M.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: 3WSFIhTu1M.exe PID: 7528, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: 3WSFIhTu1M.exe PID: 8072, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: rBRzAEam.exe PID: 8092, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: 3WSFIhTu1M.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rBRzAEam.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/95@1/2

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

File created: C:\Users\user\AppData\Roaming\rBRzAEam.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Mutant created: \Sessions\1\BaseNamedObjects\YdpVGNwgnoBmNoQi
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

File created: C:\Users\user\AppData\Local\Temp\tmp86F1.tmp

Jump to behavior

Source: 3WSFIhTu1M.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3WSFIhTu1M.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rBRzAEam.exe, 0000000E.00000002.1742446790.000000000371A000.00000004.00000800.00020000.00000000.sdmp, tmp603F.tmp.8.dr, tmp789A.tmp.8.dr, tmpEEA2.tmp.14.dr, tmp6040.tmp.8.dr, tmpCC03.tmp.14.dr, tmpEEC3.tmp.14.dr, tmp248.tmp.14.dr, tmp2789.tmp.8.dr, tmpEE62.tmp.14.dr, tmpEEA3.tmp.14.dr, tmpB327.tmp.8.dr, tmpB2F5.tmp.8.dr, tmpB64A.tmp.14.dr, tmp6061.tmp.8.dr, tmpB326.tmp.8.dr, tmpCBE3.tmp.14.dr, tmp78AA.tmp.8.dr, tmpB306.tmp.8.dr, tmp265E.tmp.14.dr, tmpCC33.tmp.14.dr, tmp259.tmp.14.dr, tmp278A.tmp.8.dr, tmp6050.tmp.8.dr, tmp219.tmp.14.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 3WSFIhTu1M.exe	ReversingLabs: Detection: 63%
Source: 3WSFIhTu1M.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

File read: C:\Users\user\Desktop\3WSFIhTu1M.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3WSFIhTu1M.exe "C:\Users\user\Desktop\3WSFIhTu1M.exe"
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Users\user\Desktop\3WSFIhTu1M.exe "C:\Users\user\Desktop\3WSFIhTu1M.exe"
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rBRzAEam.exe C:\Users\user\AppData\Roaming\rBRzAEam.exe
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Users\user\AppData\Roaming\rBRzAEam.exe "C:\Users\user\AppData\Roaming\rBRzAEam.exe"
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Users\user\Desktop\3WSFIhTu1M.exe "C:\Users\user\Desktop\3WSFIhTu1M.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Users\user\AppData\Roaming\rBRzAEam.exe "C:\Users\user\AppData\Roaming\rBRzAEam.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 3WSFIhTu1M.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3WSFIhTu1M.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 3WSFIhTu1M.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: XuOX.pdb source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr
Source:	Binary string: XuOX.pdbSHA256R source: 3WSFIhTu1M.exe, rBRzAEam.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.3WSFIhTu1M.exe.78e0000.5.raw.unpack, MainForm.cs	.Net Code: _202D_206F_202D_200E_202A_206C_202A_202A_206D_200D_206C_206A_206A_202D_200D_206A_200D_200C_200E_200F_206B_206A_206B_202D_206A_206E_206C_200C_202E_200D_206B_206A_206A_206B_200F_202B_200C_202B_200E_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	.Net Code: XNp2vRFTVM System.Reflection.Assembly.Load(byte[])
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	.Net Code: XNp2vRFTVM System.Reflection.Assembly.Load(byte[])
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	.Net Code: XNp2vRFTVM System.Reflection.Assembly.Load(byte[])

Source: 3WSFIhTu1M.exe

Static PE information: 0xF7D4D83B [Wed Oct 5 02:08:59 2101 UTC]

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_0292D7C8 push esp; ret	0_2_0292D7C9
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B60A0 push esp; ret	0_2_076B60AD
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2C2A pushfd ; iretd	0_2_076B2C30
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2B65 pushfd ; iretd	0_2_076B2B67
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2B4E pushfd ; iretd	0_2_076B2B50
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2BEA pushfd ; iretd	0_2_076B2BEC
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2BC0 pushfd ; iretd	0_2_076B2BC1
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2BD4 pushfd ; iretd	0_2_076B2BD5
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B2BA2 pushfd ; iretd	0_2_076B2BA3
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076BC8E0 push esp; retn 0004h	0_2_076BC8FC
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 0_2_076B38B0 pushad ; ret	0_2_076B38BD
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D58A38 push eax; iretd	8_2_07D58A61
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D73F50 push ebx; retf	8_2_07D74262
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D73F3F push eax; retf	8_2_07D73F42
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D7D6B3 push eax; retf	8_2_07D7D6B9
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D74650 push esi; retf	8_2_07D746CA
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D74643 push ebp; retf	8_2_07D7464A
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D74641 push esi; retf	8_2_07D74642
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D745FF push ebp; retf	8_2_07D74602
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D745A1 push ebp; retf	8_2_07D745A2
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D754FB pushad ; retf	8_2_07D75502
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D75338 pushad ; retf	8_2_07D754B2
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D75329 pushad ; retf	8_2_07D7532A
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D74270 push esp; retf	8_2_07D744D2
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D74263 push ebx; retf	8_2_07D7426A
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Code function: 8_2_07D758C8 pushad ; retf	8_2_07D758C9
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_0306D7C8 push esp; ret	10_2_0306D7C9
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D165D0 push esp; retf	10_2_05D165D9
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D11548 push cs; retf	10_2_05D11552
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D16453 pushad ; retf	10_2_05D16462
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Code function: 10_2_05D1D198 push esp; retf	10_2_05D1D19D

Source: 3WSFIhTu1M.exe	Static PE information: section name: .text entropy: 7.417859686511561
Source: rBRzAEam.exe.0.dr	Static PE information: section name: .text entropy: 7.417859686511561

Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, UVoxRJ8HId2bBCEUPy.cs	High entropy of concatenated method names: 'aOOISTRAX4', 'Qp3ICJEyBY', 'ToString', 'zONIyUwiUN', 'p00IVnVb3b', 'n49Irb7DVF', 'AFrI5p3lbl', 'yNkItheXoO', 'Qw2Idk0JWD', 'z66IE2KP3R'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, ddNxQIh3pJUBvpPSkE.cs	High entropy of concatenated method names: 'bhBPdoOhkG', 'tWBPEGNLWh', 'Dl7PSHkWF2', 'dusPC42FYe', 'nNePYBxTMR', 'eHKPmlvt88', 'Tajnd26xc2Tc27LWxF', 'ucsYG0uSObqfVu7WWN', 'AhGPPCJsYI', 'CiJPbQ9AcX'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, HfhHL3W6wLbqvkZC81.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'mcCDlO1cZh', 'pXcDFAT4hA', 'IQ8DzxN1tj', 'b7abWGYCIk', 'Q1UbPo4ILB', 'pxDbDYS82A', 'Ypabbbqxwk', 'CGKiE6ornvbwvdPNnEL'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, dtbmHsZ4ORT53Erj4C.cs	High entropy of concatenated method names: 'lhueUkt9Dj', 'S5besuQncv', 'rWBeoTdKuQ', 'RwKe8QJZUq', 'bSDewanYZl', 'KDQeiEPykP', 'qGZeuvhufq', 'k5fe4yS3Ub', 'DneepC6oC8', 'CDlejB8mgC'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, sSGyUY66T7TAFxIINs.cs	High entropy of concatenated method names: 'EP0dyqSCe2', 'LYcdr4LAMo', 'IWFdtb1FS4', 'hnntFcphaK', 'MxGtzDskDY', 'IuJdWQpuWZ', 'KcXdPcPU91', 'u0pdDngaIX', 'Yoodb7juwf', 'p26d2F4ehS'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	High entropy of concatenated method names: 'JeGbxBwlTO', 'Gp2byXjFiA', 'XqrbV7iLYo', 'F2vbrmTYRY', 'Ekkb5l2XEa', 'sVDbta7Co3', 'qBCbdLbyh5', 'lKabEiXJf3', 'c2Pb6nPDvy', 'WlFbSMSOYO'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, yuXVnSSuZT8CqDZKNB.cs	High entropy of concatenated method names: 'AjYYpHGi22', 'uDFYZ5t8N0', 'iSiYBSgkgu', 'wfLYLq9dj5', 'E0eY8egPY5', 'efUY3fffVb', 'PAHYwRwZ5d', 'U2DYi4UjXS', 'EA6Yca8ybr', 'l8tYuaDhXV'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, mTj3HR1htnrZWvc5xJO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LnaTKVuGZV', 'HHCT1kZ9sG', 'ayaTMtbsmc', 'pn6TTOjXBD', 'pRpThert45', 'VHtTRlDv7b', 'XFLTk0OZxI'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, cp1MGv1085kSbqJUGSM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Nch1jn7Owv', 'Tqq1ZPL47e', 'oPh1NHfLcX', 'fu51B8DNhx', 'EI21LixFGT', 'ova19bMHnB', 'lUh1nUrDr4'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, Pw68m9Ke22tRktcqsk.cs	High entropy of concatenated method names: 'EfcKooqMus', 'imbK8WysjA', 'mVWK3acaN8', 'W03KwTCCps', 'H7LKiWERwI', 'pxiKcmK6Y0', 'HloKuG0d05', 'L5LK4CCxU5', 'q12Kf6H54G', 'BsAKp8DhIJ'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, qhg48L506IVpwLMioj.cs	High entropy of concatenated method names: 'M2UrqlMfZK', 'IbqrG288M9', 'odlrUFiWnl', 'C28rsGla1J', 'wA1rYRMWZr', 'vRdrmCV1vx', 'NjorIk4pqH', 'sRwr7SwRT7', 'zeOrKM9mWo', 'fN4r1b6ZAl'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, CKTTIXHRAgs6Cn3lCo.cs	High entropy of concatenated method names: 'TSwvYaDDQ', 'fEnqLttt8', 'qCfGIe1VN', 'FYFQpWUdR', 'Up8snaS9i', 'RK8J8J11J', 'PB46ExVVnWe8nvdotX', 'fg17irfJLIpm3F9cJ8', 'S6Y7f5Ubd', 'dTX1ZUaeE'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, GIJ3WQ11lIGhB1w7XnH.cs	High entropy of concatenated method names: 'bai1FBUEtL', 'rCr1zwE9JH', 'dtqMWLLwmh', 'XeMMPEtpNr', 'BlQMD9dXCf', 'zUKMbKLvNW', 'OCXM2WHSWs', 'LqoMxnHr1F', 'QPrMyxKEWw', 'rDZMVOaxdt'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, b57ZAemkM6wtMkV5AT.cs	High entropy of concatenated method names: 'iwPtkTnxZg', 'DwMt0noaUX', 'vEUtveT9rN', 'kZYtq8KfKk', 'tZ4tGW0yUC', 'eZhtQFJPgs', 'WYUtseg3hG', 'nQstJk5m7y', 'vf5rLM3mydl0W26A3XI', 'wIAiGN3bHxq204VAjIU'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, VDukVIw1VWBdEhTAbi.cs	High entropy of concatenated method names: 'WQeIHyK5cG', 'POvIFjtGia', 'AbC7WJUxwt', 'yHl7PnkBKC', 'S3UIj1T0yJ', 'FU2IZ1rOFZ', 'TtUINcioMO', 'bo6IBbTwFg', 'QcTILOSXwN', 'wEkI982yUL'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, UoLtycq3RsiRyT18dv.cs	High entropy of concatenated method names: 'mYb1rud6Gi', 'qFM15XJSJO', 'Mu01t6iIbd', 'uSl1dxVhcU', 'yqE1KC87y9', 'Ff31EQTBGH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, fnnj7XxZ7lmdc8k0v8.cs	High entropy of concatenated method names: 'yobtxCE44g', 'yxhtVa0KHQ', 'oXCt5SSB9V', 'ndEtdbuaat', 'mLItEZG8DF', 'jX35XLSP4J', 'c7L5agUwbd', 'rZH5OafUyL', 'Kir5HHYode', 'Xv25lhJHum'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, HU7tFbzTwVxdT4Df4i.cs	High entropy of concatenated method names: 'bcO1GDXVo0', 'lpo1UHOgWb', 'KWy1sfRlPc', 'Q491osBqng', 'tuA18B4isr', 'V5C1wpBKjD', 'a3J1i9AXnK', 'x201kYGs7v', 'MEH10gg6lM', 'il81AWsS3r'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, vbTNB8YhNJdhuTK9Up.cs	High entropy of concatenated method names: 'Dispose', 'AJCPlACx4v', 'eKkD8234VN', 'SSKTXlDWVQ', 'RRaPFBXRLo', 'dFdPz19BcT', 'ProcessDialogKey', 'OR5DWH2xwY', 'LfRDPAkWRI', 'i0sDDopJFn'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, oXNeDNgVHFbKbBCFlj.cs	High entropy of concatenated method names: 'UrJKYtd1Dk', 'TZ9KI6lReT', 'aYaKKVHti2', 'RcsKM3lHu7', 'uRaKhiTT20', 'FQMKkPJ1CU', 'Dispose', 't0V7ylSraj', 'U017VTMM6H', 'sIj7rm9CkS'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, TdvR6eQTXedhRUweF5.cs	High entropy of concatenated method names: 'PW8d0QheTW', 'LARdAbTpSw', 'EICdvNPOZN', 'AxEdq63Xqx', 'cpbdgfRvyo', 'gtRdGMRWwT', 'wYXdQptZFe', 'arHdU2Gg5L', 'eD2dsJUYYo', 'MbMdJbi7rP'
Source: 0.2.3WSFIhTu1M.exe.44a41c0.1.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	High entropy of concatenated method names: 'sonVBulbqi', 'YGiVLW6xfu', 'srUV9rdyL7', 'yJxVnNRIIU', 'BQjVXfbGHK', 'WELVaDxv4t', 'VW0VObpGTh', 'mD7VHsjZ7E', 'fJvVlxTCpo', 'JDfVFgVi1N'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, UVoxRJ8HId2bBCEUPy.cs	High entropy of concatenated method names: 'aOOISTRAX4', 'Qp3ICJEyBY', 'ToString', 'zONIyUwiUN', 'p00IVnVb3b', 'n49Irb7DVF', 'AFrI5p3lbl', 'yNkItheXoO', 'Qw2Idk0JWD', 'z66IE2KP3R'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, ddNxQIh3pJUBvpPSkE.cs	High entropy of concatenated method names: 'bhBPdoOhkG', 'tWBPEGNLWh', 'Dl7PSHkWF2', 'dusPC42FYe', 'nNePYBxTMR', 'eHKPmlvt88', 'Tajnd26xc2Tc27LWxF', 'ucsYG0uSObqfVu7WWN', 'AhGPPCJsYI', 'CiJPbQ9AcX'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, HfhHL3W6wLbqvkZC81.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'mcCDlO1cZh', 'pXcDFAT4hA', 'IQ8DzxN1tj', 'b7abWGYCIk', 'Q1UbPo4ILB', 'pxDbDYS82A', 'Ypabbbqxwk', 'CGKiE6ornvbwvdPNnEL'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, dtbmHsZ4ORT53Erj4C.cs	High entropy of concatenated method names: 'lhueUkt9Dj', 'S5besuQncv', 'rWBeoTdKuQ', 'RwKe8QJZUq', 'bSDewanYZl', 'KDQeiEPykP', 'qGZeuvhufq', 'k5fe4yS3Ub', 'DneepC6oC8', 'CDlejB8mgC'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, sSGyUY66T7TAFxIINs.cs	High entropy of concatenated method names: 'EP0dyqSCe2', 'LYcdr4LAMo', 'IWFdtb1FS4', 'hnntFcphaK', 'MxGtzDskDY', 'IuJdWQpuWZ', 'KcXdPcPU91', 'u0pdDngaIX', 'Yoodb7juwf', 'p26d2F4ehS'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	High entropy of concatenated method names: 'JeGbxBwlTO', 'Gp2byXjFiA', 'XqrbV7iLYo', 'F2vbrmTYRY', 'Ekkb5l2XEa', 'sVDbta7Co3', 'qBCbdLbyh5', 'lKabEiXJf3', 'c2Pb6nPDvy', 'WlFbSMSOYO'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, yuXVnSSuZT8CqDZKNB.cs	High entropy of concatenated method names: 'AjYYpHGi22', 'uDFYZ5t8N0', 'iSiYBSgkgu', 'wfLYLq9dj5', 'E0eY8egPY5', 'efUY3fffVb', 'PAHYwRwZ5d', 'U2DYi4UjXS', 'EA6Yca8ybr', 'l8tYuaDhXV'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, mTj3HR1htnrZWvc5xJO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LnaTKVuGZV', 'HHCT1kZ9sG', 'ayaTMtbsmc', 'pn6TTOjXBD', 'pRpThert45', 'VHtTRlDv7b', 'XFLTk0OZxI'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, cp1MGv1085kSbqJUGSM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Nch1jn7Owv', 'Tqq1ZPL47e', 'oPh1NHfLcX', 'fu51B8DNhx', 'EI21LixFGT', 'ova19bMHnB', 'lUh1nUrDr4'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, Pw68m9Ke22tRktcqsk.cs	High entropy of concatenated method names: 'EfcKooqMus', 'imbK8WysjA', 'mVWK3acaN8', 'W03KwTCCps', 'H7LKiWERwI', 'pxiKcmK6Y0', 'HloKuG0d05', 'L5LK4CCxU5', 'q12Kf6H54G', 'BsAKp8DhIJ'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, qhg48L506IVpwLMioj.cs	High entropy of concatenated method names: 'M2UrqlMfZK', 'IbqrG288M9', 'odlrUFiWnl', 'C28rsGla1J', 'wA1rYRMWZr', 'vRdrmCV1vx', 'NjorIk4pqH', 'sRwr7SwRT7', 'zeOrKM9mWo', 'fN4r1b6ZAl'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, CKTTIXHRAgs6Cn3lCo.cs	High entropy of concatenated method names: 'TSwvYaDDQ', 'fEnqLttt8', 'qCfGIe1VN', 'FYFQpWUdR', 'Up8snaS9i', 'RK8J8J11J', 'PB46ExVVnWe8nvdotX', 'fg17irfJLIpm3F9cJ8', 'S6Y7f5Ubd', 'dTX1ZUaeE'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, GIJ3WQ11lIGhB1w7XnH.cs	High entropy of concatenated method names: 'bai1FBUEtL', 'rCr1zwE9JH', 'dtqMWLLwmh', 'XeMMPEtpNr', 'BlQMD9dXCf', 'zUKMbKLvNW', 'OCXM2WHSWs', 'LqoMxnHr1F', 'QPrMyxKEWw', 'rDZMVOaxdt'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, b57ZAemkM6wtMkV5AT.cs	High entropy of concatenated method names: 'iwPtkTnxZg', 'DwMt0noaUX', 'vEUtveT9rN', 'kZYtq8KfKk', 'tZ4tGW0yUC', 'eZhtQFJPgs', 'WYUtseg3hG', 'nQstJk5m7y', 'vf5rLM3mydl0W26A3XI', 'wIAiGN3bHxq204VAjIU'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, VDukVIw1VWBdEhTAbi.cs	High entropy of concatenated method names: 'WQeIHyK5cG', 'POvIFjtGia', 'AbC7WJUxwt', 'yHl7PnkBKC', 'S3UIj1T0yJ', 'FU2IZ1rOFZ', 'TtUINcioMO', 'bo6IBbTwFg', 'QcTILOSXwN', 'wEkI982yUL'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, UoLtycq3RsiRyT18dv.cs	High entropy of concatenated method names: 'mYb1rud6Gi', 'qFM15XJSJO', 'Mu01t6iIbd', 'uSl1dxVhcU', 'yqE1KC87y9', 'Ff31EQTBGH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, fnnj7XxZ7lmdc8k0v8.cs	High entropy of concatenated method names: 'yobtxCE44g', 'yxhtVa0KHQ', 'oXCt5SSB9V', 'ndEtdbuaat', 'mLItEZG8DF', 'jX35XLSP4J', 'c7L5agUwbd', 'rZH5OafUyL', 'Kir5HHYode', 'Xv25lhJHum'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, HU7tFbzTwVxdT4Df4i.cs	High entropy of concatenated method names: 'bcO1GDXVo0', 'lpo1UHOgWb', 'KWy1sfRlPc', 'Q491osBqng', 'tuA18B4isr', 'V5C1wpBKjD', 'a3J1i9AXnK', 'x201kYGs7v', 'MEH10gg6lM', 'il81AWsS3r'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, vbTNB8YhNJdhuTK9Up.cs	High entropy of concatenated method names: 'Dispose', 'AJCPlACx4v', 'eKkD8234VN', 'SSKTXlDWVQ', 'RRaPFBXRLo', 'dFdPz19BcT', 'ProcessDialogKey', 'OR5DWH2xwY', 'LfRDPAkWRI', 'i0sDDopJFn'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, oXNeDNgVHFbKbBCFlj.cs	High entropy of concatenated method names: 'UrJKYtd1Dk', 'TZ9KI6lReT', 'aYaKKVHti2', 'RcsKM3lHu7', 'uRaKhiTT20', 'FQMKkPJ1CU', 'Dispose', 't0V7ylSraj', 'U017VTMM6H', 'sIj7rm9CkS'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, TdvR6eQTXedhRUweF5.cs	High entropy of concatenated method names: 'PW8d0QheTW', 'LARdAbTpSw', 'EICdvNPOZN', 'AxEdq63Xqx', 'cpbdgfRvyo', 'gtRdGMRWwT', 'wYXdQptZFe', 'arHdU2Gg5L', 'eD2dsJUYYo', 'MbMdJbi7rP'
Source: 0.2.3WSFIhTu1M.exe.45005e0.0.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	High entropy of concatenated method names: 'sonVBulbqi', 'YGiVLW6xfu', 'srUV9rdyL7', 'yJxVnNRIIU', 'BQjVXfbGHK', 'WELVaDxv4t', 'VW0VObpGTh', 'mD7VHsjZ7E', 'fJvVlxTCpo', 'JDfVFgVi1N'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, UVoxRJ8HId2bBCEUPy.cs	High entropy of concatenated method names: 'aOOISTRAX4', 'Qp3ICJEyBY', 'ToString', 'zONIyUwiUN', 'p00IVnVb3b', 'n49Irb7DVF', 'AFrI5p3lbl', 'yNkItheXoO', 'Qw2Idk0JWD', 'z66IE2KP3R'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, ddNxQIh3pJUBvpPSkE.cs	High entropy of concatenated method names: 'bhBPdoOhkG', 'tWBPEGNLWh', 'Dl7PSHkWF2', 'dusPC42FYe', 'nNePYBxTMR', 'eHKPmlvt88', 'Tajnd26xc2Tc27LWxF', 'ucsYG0uSObqfVu7WWN', 'AhGPPCJsYI', 'CiJPbQ9AcX'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, HfhHL3W6wLbqvkZC81.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'mcCDlO1cZh', 'pXcDFAT4hA', 'IQ8DzxN1tj', 'b7abWGYCIk', 'Q1UbPo4ILB', 'pxDbDYS82A', 'Ypabbbqxwk', 'CGKiE6ornvbwvdPNnEL'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, dtbmHsZ4ORT53Erj4C.cs	High entropy of concatenated method names: 'lhueUkt9Dj', 'S5besuQncv', 'rWBeoTdKuQ', 'RwKe8QJZUq', 'bSDewanYZl', 'KDQeiEPykP', 'qGZeuvhufq', 'k5fe4yS3Ub', 'DneepC6oC8', 'CDlejB8mgC'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, sSGyUY66T7TAFxIINs.cs	High entropy of concatenated method names: 'EP0dyqSCe2', 'LYcdr4LAMo', 'IWFdtb1FS4', 'hnntFcphaK', 'MxGtzDskDY', 'IuJdWQpuWZ', 'KcXdPcPU91', 'u0pdDngaIX', 'Yoodb7juwf', 'p26d2F4ehS'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, pJJSSUMm4j1LXWiVQE.cs	High entropy of concatenated method names: 'JeGbxBwlTO', 'Gp2byXjFiA', 'XqrbV7iLYo', 'F2vbrmTYRY', 'Ekkb5l2XEa', 'sVDbta7Co3', 'qBCbdLbyh5', 'lKabEiXJf3', 'c2Pb6nPDvy', 'WlFbSMSOYO'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, yuXVnSSuZT8CqDZKNB.cs	High entropy of concatenated method names: 'AjYYpHGi22', 'uDFYZ5t8N0', 'iSiYBSgkgu', 'wfLYLq9dj5', 'E0eY8egPY5', 'efUY3fffVb', 'PAHYwRwZ5d', 'U2DYi4UjXS', 'EA6Yca8ybr', 'l8tYuaDhXV'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, mTj3HR1htnrZWvc5xJO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LnaTKVuGZV', 'HHCT1kZ9sG', 'ayaTMtbsmc', 'pn6TTOjXBD', 'pRpThert45', 'VHtTRlDv7b', 'XFLTk0OZxI'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, cp1MGv1085kSbqJUGSM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Nch1jn7Owv', 'Tqq1ZPL47e', 'oPh1NHfLcX', 'fu51B8DNhx', 'EI21LixFGT', 'ova19bMHnB', 'lUh1nUrDr4'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, Pw68m9Ke22tRktcqsk.cs	High entropy of concatenated method names: 'EfcKooqMus', 'imbK8WysjA', 'mVWK3acaN8', 'W03KwTCCps', 'H7LKiWERwI', 'pxiKcmK6Y0', 'HloKuG0d05', 'L5LK4CCxU5', 'q12Kf6H54G', 'BsAKp8DhIJ'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, qhg48L506IVpwLMioj.cs	High entropy of concatenated method names: 'M2UrqlMfZK', 'IbqrG288M9', 'odlrUFiWnl', 'C28rsGla1J', 'wA1rYRMWZr', 'vRdrmCV1vx', 'NjorIk4pqH', 'sRwr7SwRT7', 'zeOrKM9mWo', 'fN4r1b6ZAl'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, CKTTIXHRAgs6Cn3lCo.cs	High entropy of concatenated method names: 'TSwvYaDDQ', 'fEnqLttt8', 'qCfGIe1VN', 'FYFQpWUdR', 'Up8snaS9i', 'RK8J8J11J', 'PB46ExVVnWe8nvdotX', 'fg17irfJLIpm3F9cJ8', 'S6Y7f5Ubd', 'dTX1ZUaeE'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, GIJ3WQ11lIGhB1w7XnH.cs	High entropy of concatenated method names: 'bai1FBUEtL', 'rCr1zwE9JH', 'dtqMWLLwmh', 'XeMMPEtpNr', 'BlQMD9dXCf', 'zUKMbKLvNW', 'OCXM2WHSWs', 'LqoMxnHr1F', 'QPrMyxKEWw', 'rDZMVOaxdt'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, b57ZAemkM6wtMkV5AT.cs	High entropy of concatenated method names: 'iwPtkTnxZg', 'DwMt0noaUX', 'vEUtveT9rN', 'kZYtq8KfKk', 'tZ4tGW0yUC', 'eZhtQFJPgs', 'WYUtseg3hG', 'nQstJk5m7y', 'vf5rLM3mydl0W26A3XI', 'wIAiGN3bHxq204VAjIU'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, VDukVIw1VWBdEhTAbi.cs	High entropy of concatenated method names: 'WQeIHyK5cG', 'POvIFjtGia', 'AbC7WJUxwt', 'yHl7PnkBKC', 'S3UIj1T0yJ', 'FU2IZ1rOFZ', 'TtUINcioMO', 'bo6IBbTwFg', 'QcTILOSXwN', 'wEkI982yUL'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, UoLtycq3RsiRyT18dv.cs	High entropy of concatenated method names: 'mYb1rud6Gi', 'qFM15XJSJO', 'Mu01t6iIbd', 'uSl1dxVhcU', 'yqE1KC87y9', 'Ff31EQTBGH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, fnnj7XxZ7lmdc8k0v8.cs	High entropy of concatenated method names: 'yobtxCE44g', 'yxhtVa0KHQ', 'oXCt5SSB9V', 'ndEtdbuaat', 'mLItEZG8DF', 'jX35XLSP4J', 'c7L5agUwbd', 'rZH5OafUyL', 'Kir5HHYode', 'Xv25lhJHum'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, HU7tFbzTwVxdT4Df4i.cs	High entropy of concatenated method names: 'bcO1GDXVo0', 'lpo1UHOgWb', 'KWy1sfRlPc', 'Q491osBqng', 'tuA18B4isr', 'V5C1wpBKjD', 'a3J1i9AXnK', 'x201kYGs7v', 'MEH10gg6lM', 'il81AWsS3r'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, vbTNB8YhNJdhuTK9Up.cs	High entropy of concatenated method names: 'Dispose', 'AJCPlACx4v', 'eKkD8234VN', 'SSKTXlDWVQ', 'RRaPFBXRLo', 'dFdPz19BcT', 'ProcessDialogKey', 'OR5DWH2xwY', 'LfRDPAkWRI', 'i0sDDopJFn'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, oXNeDNgVHFbKbBCFlj.cs	High entropy of concatenated method names: 'UrJKYtd1Dk', 'TZ9KI6lReT', 'aYaKKVHti2', 'RcsKM3lHu7', 'uRaKhiTT20', 'FQMKkPJ1CU', 'Dispose', 't0V7ylSraj', 'U017VTMM6H', 'sIj7rm9CkS'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, TdvR6eQTXedhRUweF5.cs	High entropy of concatenated method names: 'PW8d0QheTW', 'LARdAbTpSw', 'EICdvNPOZN', 'AxEdq63Xqx', 'cpbdgfRvyo', 'gtRdGMRWwT', 'wYXdQptZFe', 'arHdU2Gg5L', 'eD2dsJUYYo', 'MbMdJbi7rP'
Source: 0.2.3WSFIhTu1M.exe.76c0000.4.raw.unpack, b5P4ebsHhMnNpdmA4r.cs	High entropy of concatenated method names: 'sonVBulbqi', 'YGiVLW6xfu', 'srUV9rdyL7', 'yJxVnNRIIU', 'BQjVXfbGHK', 'WELVaDxv4t', 'VW0VObpGTh', 'mD7VHsjZ7E', 'fJvVlxTCpo', 'JDfVFgVi1N'

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

File created: C:\Users\user\AppData\Roaming\rBRzAEam.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 63615 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63615
Source: unknown	Network traffic detected: HTTP traffic on port 63616 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63616
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 63618 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63618
Source: unknown	Network traffic detected: HTTP traffic on port 63619 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 63619

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 8092, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 4AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 8DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 7290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 9DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: ADC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: C1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: D1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory allocated: 27F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 3290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 8F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 9F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: AF30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: B3D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: C3D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 3080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory allocated: 3080000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Code function: 0_2_076AA8B1 sldt word ptr [56EC8B55h]

0_2_076AA8B1

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6181	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3518	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Window / User API: threadDelayed 2434	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Window / User API: threadDelayed 5341	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Window / User API: threadDelayed 1395
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Window / User API: threadDelayed 7641

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe TID: 7556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe TID: 2976	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe TID: 7244	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe TID: 5560	Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe TID: 2772	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe TID: 2464	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Thread delayed: delay time: 922337203685477

Source: tmp3835.tmp.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: tmp3835.tmp.14.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: tmp3835.tmp.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: tmp3835.tmp.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: tmp3835.tmp.14.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: tmp3835.tmp.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: tmp3835.tmp.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: tmp3835.tmp.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: tmp3835.tmp.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: rBRzAEam.exe, 0000000E.00000002.1741061918.0000000001620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp3835.tmp.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: tmp3835.tmp.14.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: tmp3835.tmp.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: tmp3835.tmp.14.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: tmp3835.tmp.14.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: tmp3835.tmp.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: tmp3835.tmp.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 3WSFIhTu1M.exe, 00000008.00000002.1668575367.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: tmp3835.tmp.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: tmp3835.tmp.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: tmp3835.tmp.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Code function: 0_2_0112D6C0 LdrInitializeThunk,

0_2_0112D6C0

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe"
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Memory written: C:\Users\user\Desktop\3WSFIhTu1M.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Memory written: C:\Users\user\AppData\Roaming\rBRzAEam.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rBRzAEam.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmp86F1.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Process created: C:\Users\user\Desktop\3WSFIhTu1M.exe "C:\Users\user\Desktop\3WSFIhTu1M.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBRzAEam" /XML "C:\Users\user\AppData\Local\Temp\tmpA74B.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Process created: C:\Users\user\AppData\Roaming\rBRzAEam.exe "C:\Users\user\AppData\Roaming\rBRzAEam.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Users\user\Desktop\3WSFIhTu1M.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Users\user\Desktop\3WSFIhTu1M.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Users\user\AppData\Roaming\rBRzAEam.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Users\user\AppData\Roaming\rBRzAEam.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 3WSFIhTu1M.exe, 00000008.00000002.1689686763.00000000061EC000.00000004.00000020.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1768161340.0000000007E7D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 2056, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets
Source: 3WSFIhTu1M.exe, 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumtFY
Source: 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\3WSFIhTu1M.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\rBRzAEam.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 2056, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.rBRzAEam.exe.4badcd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.3WSFIhTu1M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4b95eb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.45b1ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.459a0d0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4badcd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3WSFIhTu1M.exe.459a0d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rBRzAEam.exe.4b95eb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541134459.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1541134459.000000000459A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3WSFIhTu1M.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rBRzAEam.exe PID: 2056, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	1 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3WSFIhTu1M.exe	63%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
3WSFIhTu1M.exe	61%	Virustotal		Browse
3WSFIhTu1M.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\rBRzAEam.exe	63%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Source	Detection	Scanner	Label
http://185.222.58.254:55615	0%	Avira URL Cloud	safe
http://185.222.58.254:55615/	0%	Avira URL Cloud	safe
185.222.58.254:55615	0%	Avira URL Cloud	safe
https://api.ipify.orgcoo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	104.26.13.31	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ip.sb/geoip	false		high
http://185.222.58.254:55615/	true	Avira URL Cloud: safe	unknown
185.222.58.254:55615	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	3WSFIhTu1M.exe, 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
https://duckduckgo.com/ac/?q=	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	3WSFIhTu1M.exe, 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.222.58.254:55615	3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, 3WSFIhTu1M.exe, 00000008.00000002.1671100528.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000033FC000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
http://tempuri.org/	rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
https://www.ecosia.org/newtab/	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	false		high
http://tempuri.org/Endpoint/SetEnvironment	rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/DatabaseCore.xsd	3WSFIhTu1M.exe, rBRzAEam.exe.0.dr	false		high
http://tempuri.org/Endpoint/GetUpdates	rBRzAEam.exe, 0000000E.00000002.1742446790.00000000033FC000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.00000000032E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	3WSFIhTu1M.exe, 3WSFIhTu1M.exe, 00000008.00000002.1668157430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1635003533.0000000004B95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	3WSFIhTu1M.exe, 00000000.00000002.1538059937.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, 3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000A.00000002.1628477749.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp2738.tmp.8.dr, tmpCBD2.tmp.14.dr, tmp5DFD.tmp.14.dr, tmp952E.tmp.14.dr, tmpED25.tmp.8.dr, tmpB347.tmp.8.dr, tmp2708.tmp.8.dr, tmp26BF.tmp.14.dr, tmp5E1D.tmp.14.dr, tmp5E3D.tmp.14.dr, tmp955E.tmp.14.dr, tmpED45.tmp.8.dr, tmp267E.tmp.14.dr, tmpCBC1.tmp.14.dr, tmp269F.tmp.14.dr, tmp2758.tmp.8.dr, tmp26C8.tmp.8.dr, tmp953E.tmp.14.dr, tmpED76.tmp.8.dr, tmp2769.tmp.8.dr, tmp951D.tmp.14.dr	false		high
https://api.ipify.orgcoo	3WSFIhTu1M.exe	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	3WSFIhTu1M.exe, 00000008.00000002.1671100528.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, rBRzAEam.exe, 0000000E.00000002.1742446790.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.31	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
185.222.58.254	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1609372
Start date and time:	2025-02-07 16:53:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3WSFIhTu1M.exe renamed because original name is a hash value
Original Sample Name:	5c7dfeaaab049b0c4a2b6fe06c7d6d8d54202ab9b5ba637b73faa01bccb5debc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@18/95@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 364 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:54:21	API Interceptor	43x Sleep call for process: 3WSFIhTu1M.exe modified
10:54:26	API Interceptor	38x Sleep call for process: powershell.exe modified
10:54:32	API Interceptor	48x Sleep call for process: rBRzAEam.exe modified
16:54:29	Task Scheduler	Run new task: rBRzAEam path: C:\Users\user\AppData\Roaming\rBRzAEam.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.31	VKJITO.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	ip.sb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	https://je.engl6.shop/webro-DPD-notificare/	Get hash	malicious	Unknown	Browse	172.67.75.172
	https://tt.vg/notificareDPD02	Get hash	malicious	Unknown	Browse	172.67.75.172
	https://link.edgepilot.com/s/bdf73872/M_dKU1V6ukKrJCNGUbq_fQ?u=https://sixthou.dkamenginearing.com/?java=wihc%23aW5mb0BkY25keC5jb20%3D	Get hash	malicious	HTMLPhisher	Browse	104.26.12.31
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, RedLine, Stealc, Vidar	Browse	172.67.75.172
	random.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	104.26.12.31
	update.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	TutBuixe6B.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar	Browse	104.26.12.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTLAYERNETNL	qJ64p5G1XJ.exe	Get hash	malicious	RedLine	Browse	45.137.22.227
	chTJmCR9bS.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.222.57.84
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	185.222.57.67
	p0GiAimtNm.exe	Get hash	malicious	RedLine	Browse	185.222.58.237
	nzLoHpgAln.exe	Get hash	malicious	RedLine	Browse	185.222.57.76
	ljMiHZ8MwZ.exe	Get hash	malicious	RedLine	Browse	45.137.22.250
	aYf5ibGObB.exe	Get hash	malicious	RedLine	Browse	185.222.58.90
	K3xL5Xy0XS.exe	Get hash	malicious	RedLine	Browse	185.222.58.90
	Invoice-BL. Payment TT $ 16945.99.exe	Get hash	malicious	RedLine	Browse	45.137.22.164
	MfzXU6tKOq.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.222.58.82
CLOUDFLARENETUS	SBnIqnD6ap.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	https://blw.esminjuntat.ru/g9y8	Get hash	malicious	Unknown	Browse	104.21.96.1
	HPXZJTpLdF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	k2ax9F6u0c.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	vFfM8ihiqU.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	NiOh5ZpzvW.exe	Get hash	malicious	FormBook	Browse	104.21.76.194
	Rd5fEV88hb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	zqTbhyfe12.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	b3.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	b1.elf	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SBnIqnD6ap.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.31
	HPXZJTpLdF.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.31
	vFfM8ihiqU.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	Rd5fEV88hb.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.31
	zqTbhyfe12.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	62ymqatXRt.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	CdL8Vi5z8O.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	btDlsPXETF.exe	Get hash	malicious	DarkTortilla, MassLogger RAT	Browse	104.26.13.31
	zJy0ie9x9Q.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	7OOHgjSApQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rBRzAEam.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:fLHyIFKL3IZ2KRH9Oug8s
MD5:	4DC84D28CF28EAE82806A5390E5721C8
SHA1:	66B6385EB104A782AD3737F2C302DEC0231ADEA2
SHA-256:	1B89BFB0F44C267035B5BC9B2A8692FF29440C0FEE71C636B377751DAF6911C0
SHA-512:	E8F45669D27975B41401419B8438E8F6219AF4D864C46B8E19DC5ECD50BD6CA589BDEEE600A73DDB27F8A8B4FF7318000641B6A59E0A5CDD7BE0C82D969A68DE
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0m2wabdy.w5i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy5j1azc.ozx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rirsjz4o.ojz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ve5jbmhi.w34.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp219.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp248.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp259.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp265E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp267E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp269F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp26A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp26A7.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp26BF.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp26C8.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp26E8.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2708.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2738.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2758.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2769.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2789.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp278A.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp37E2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp37F3.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3803.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3814.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3825.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3835.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3856.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5DFD.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5E1D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5E3D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp603F.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6040.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6050.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6061.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6062.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6082.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6D51.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6D62.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6D72.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6D83.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6D94.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6DA4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp789A.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp78AA.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp797.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7A8.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7B8.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7C9.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7E9.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7FA.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp86F1.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.107022626407916
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtBxvn:cgeLAYrFdOFzOzN33ODOiDdKrsuTHv
MD5:	10524389001CA1014E01D15D71A60F7A
SHA1:	AAA4F5FF2B1A3A085AAD34B8AE495B438089826D
SHA-256:	654F847BBA78EE030F91BBE4DCBD0ACFB16BBA1FAB4BDE4ADE7A42531EFB9DDC
SHA-512:	C4A121285370246206328AA7CF991BEECBF42F031DDF8B0F5192D3A9E9204602479AC5A317E411F5D1397B5E51A9B74288E8415661B482E65DE4D8248B27E931
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp951D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp952E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp953E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp955E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp98AA.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp98F9.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA74B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.107022626407916
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtBxvn:cgeLAYrFdOFzOzN33ODOiDdKrsuTHv
MD5:	10524389001CA1014E01D15D71A60F7A
SHA1:	AAA4F5FF2B1A3A085AAD34B8AE495B438089826D
SHA-256:	654F847BBA78EE030F91BBE4DCBD0ACFB16BBA1FAB4BDE4ADE7A42531EFB9DDC
SHA-512:	C4A121285370246206328AA7CF991BEECBF42F031DDF8B0F5192D3A9E9204602479AC5A317E411F5D1397B5E51A9B74288E8415661B482E65DE4D8248B27E931
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpAD4E.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpAD4F.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpAD60.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpAD61.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpB2F5.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB306.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB326.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB327.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB347.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB64A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCBC1.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCBD2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCBE3.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCC03.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCC33.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0D3.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0F4.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD104.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD115.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6EE.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpD6EF.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpD700.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpD701.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rBRzAEam.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpED25.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpED45.tmp

Download File

Process:	C:\Users\user\Desktop\3WSFIhTu1M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3WSFIhTu1M.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3WSFIhTu1M.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rBRzAEam.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0m2wabdy.w5i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy5j1azc.ozx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rirsjz4o.ojz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ve5jbmhi.w34.ps1

C:\Users\user\AppData\Local\Temp\tmp219.tmp

C:\Users\user\AppData\Local\Temp\tmp248.tmp

Windows Analysis Report
3WSFIhTu1M.exe