Windows Analysis Report 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

AV Detection:

Found malware configuration

Source: 1.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.393a170.4.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.137.155.31:11556"], "Bot Id": "1"}

Multi AV Scanner detection for submitted file

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Virustotal: Detection: 38%			Perma Link
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	ReversingLabs: Detection: 67%

Compliance:

Uses 32bit PE files

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: System.ServiceModel.pdbl6 source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468518828.000000000112E000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbj source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468229225.00000000010A2000.00000004.00000020.sdmp
Source:	Binary string: jHC:\Windows\System.ServiceModel.pdb source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.466476163.0000000000CF8000.00000004.00000001.sdmp

Networking:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49725 -> 45.137.155.31:11556

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflate

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: VOLIA-ASUA VOLIA-ASUA

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.155.31

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetArguments"Host: 45.137.155.31:11556Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

URLs found in memory or binary data

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp, 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469171035.0000000002C62000.00000004.00000001.sdmp	String found in binary or memory: http://45.137.155.31:11556
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://45.137.155.31:11556/
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://45.137.155.31:115564
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468837509.0000000002BC1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469171035.0000000002C62000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469171035.0000000002C62000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468837509.0000000002BC1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468837509.0000000002BC1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468837509.0000000002BC1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469143603.0000000002C5A000.00000004.00000001.sdmp, 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469171035.0000000002C62000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469143603.0000000002C5A000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/0
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.469171035.0000000002C62000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetArguments
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetArgumentsResponse$
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse$
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyScanRequest
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyScanRequestResponse$
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468860488.0000000002BC8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse$
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp, 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.465623603.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp, 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.465623603.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ipify.org
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp, 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.465623603.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://icanhazip.com5https://wtfismyip.com/textChttp://bot.whatismyipaddress.com/3http://checkip.dy
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp, 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.465623603.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	String found in binary or memory: https://sectigo.com/CPS0D

System Summary:

Detected potential crypto function

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_0279C25C		1_2_0279C25C
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_0279E1D0		1_2_0279E1D0
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_0279E1C0		1_2_0279E1C0
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_04E44088		1_2_04E44088
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_04E451C0		1_2_04E451C0
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_04E4E860		1_2_04E4E860
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_01067248		2_2_01067248
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_01067258		2_2_01067258
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050FB448		2_2_050FB448
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050FBAB0		2_2_050FBAB0
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050FC571		2_2_050FC571
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050F2F60		2_2_050F2F60
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050FDF78		2_2_050FDF78
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050FDF88		2_2_050FDF88
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_05160040		2_2_05160040
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_05163AC0		2_2_05163AC0

PE / OLE file has an invalid certificate

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: invalid certificate

PE file contains strange resources

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.221997766.0000000002911000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameIsaacCore.dll4 vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSwells.exe4 vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000001.00000002.220976731.00000000005CE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMethodAttributes.exe\ vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.466285029.00000000008DE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMethodAttributes.exe\ vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468118490.000000000107A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.465827946.000000000041A000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameSwells.exe4 vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Binary or memory string: OriginalFilenameMethodAttributes.exe\ vs 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Uses 32bit PE files

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal68.troj.winEXE@3/1@0/1

Creates files inside the user directory

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.log

Jump to behavior

PE file has an executable .text section and no other executable section

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Virustotal: Detection: 38%
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	ReversingLabs: Detection: 67%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe 'C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe'
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process created: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process created: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: System.ServiceModel.pdbl6 source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468518828.000000000112E000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbj source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468229225.00000000010A2000.00000004.00000020.sdmp
Source:	Binary string: jHC:\Windows\System.ServiceModel.pdb source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.466476163.0000000000CF8000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 1_2_0279F990 pushfd ; iretd		1_2_0279F991
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050FA1F7 push E801005Eh; retf		2_2_050FA201
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Code function: 2_2_050F98A0 push 38050ACBh; retf		2_2_050F98A5

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.50941268753

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 11556
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 11556 -> 49725

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe TID: 2120	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe TID: 3216	Thread sleep count: 77 > 30			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe TID: 3216	Thread sleep time: -77000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Last function: Thread delayed

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Process token adjusted: Debug			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Process created: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468601055.0000000001600000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468601055.0000000001600000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468601055.0000000001600000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe, 00000002.00000002.468601055.0000000001600000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Source: Yara match	File source: 1.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.393a170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.393a170.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.465623603.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe PID: 968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe PID: 992, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Source: Yara match	File source: 1.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.393a170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.393a170.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.465623603.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.223233962.000000000393A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe PID: 968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7C3BEB3D9B0A8E0BDC6344A24B3B527B96CB9C845AA68.exe PID: 992, type: MEMORYSTR