Windows Analysis Report JSHRF6iG8A.exe

AV Detection:

Found malware configuration

Source: 0.2.JSHRF6iG8A.exe.4a30000.3.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.9.20.20:13441"], "Bot Id": "UTS"}

Multi AV Scanner detection for submitted file

Source: JSHRF6iG8A.exe	Virustotal: Detection: 32%			Perma Link
Source: JSHRF6iG8A.exe	ReversingLabs: Detection: 50%

Machine Learning detection for sample

Source: JSHRF6iG8A.exe

Joe Sandbox ML: detected

Compliance:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Unpacked PE file: 0.2.JSHRF6iG8A.exe.400000.0.unpack

Uses 32bit PE files

Source: JSHRF6iG8A.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: _.pdb source: JSHRF6iG8A.exe, 00000000.00000002.369773109.0000000004A30000.00000004.00020000.sdmp
Source:	Binary string: C:\nahamuwozimaxo\rakegapapuhof.pdb source: JSHRF6iG8A.exe
Source:	Binary string: 3KOC:\nahamuwozimaxo\rakegapapuhof.pdb source: JSHRF6iG8A.exe

Networking:

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: DEDIPATH-LLCUS DEDIPATH-LLCUS

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 45.9.20.20 45.9.20.20

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49751 -> 45.9.20.20:13441

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.20

Found strings which match to known social media urls

Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp

String found in binary or memory: gl9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp

String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

URLs found in memory or binary data

Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: JSHRF6iG8A.exe, 00000000.00000002.375077209.0000000008AB0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/AckRequested
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CloseSequence
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CloseSequenceResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequenceResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/SequenceAcknowledgement
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequence
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequenceResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/fault
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1$
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/sct
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512#BinarySecret
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/AsymmetricKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/CK/PSHA1
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Nonce
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Aborted
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Commit
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Committed
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Completion
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Durable2PC
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Prepare
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Prepared
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/ReadOnly
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Replay
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Rollback
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Volatile2PC
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/fault
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContext
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContextResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/Register
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/RegisterResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/fault
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: JSHRF6iG8A.exe, 00000000.00000002.371604089.00000000052C3000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessageD
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessagePale
Source: JSHRF6iG8A.exe, 00000000.00000002.371861396.0000000005417000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessagel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity$
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/Confirm
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/ConfirmResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/Init
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitDisplay
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitDisplayResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartBrowsers
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartBrowsersResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartColdWallets
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartColdWalletsResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDefenders
Source: JSHRF6iG8A.exe, 00000000.00000002.371604089.00000000052C3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDefendersResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDiscord
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDiscordResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartFtpConnections
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartFtpConnectionsResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartHardwares
Source: JSHRF6iG8A.exe, 00000000.00000002.371604089.00000000052C3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartHardwaresResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledBrowsers
Source: JSHRF6iG8A.exe, 00000000.00000002.371604089.00000000052C3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledBrowsersResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledSoftwares
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledSoftwaresResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartLanguages
Source: JSHRF6iG8A.exe, 00000000.00000002.371604089.00000000052C3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartLanguagesResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartNordVPN
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartNordVPNResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartOpenVPN
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartOpenVPNResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProcesses
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProcessesResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProtonVPN
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProtonVPNResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartScannedFiles
Source: JSHRF6iG8A.exe, 00000000.00000002.371604089.00000000052C3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartScannedFilesResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartSteamFiles
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartSteamFilesResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartTelegramFiles
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartTelegramFilesResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: JSHRF6iG8A.exe, 00000000.00000002.371376709.00000000051E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.o
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb
Source: JSHRF6iG8A.exe, 00000000.00000002.371445737.0000000005273000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: JSHRF6iG8A.exe, 00000000.00000002.372796000.00000000061E5000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.c
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favico
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp	String found in binary or memory: https://search.yaho
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: JSHRF6iG8A.exe, 00000000.00000002.372034445.0000000005479000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, JSHRF6iG8A.exe, 00000000.00000002.372225505.00000000054D1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: JSHRF6iG8A.exe, 00000000.00000002.378604572.000000000A52D000.00000004.00000001.sdmp	String found in binary or memory: https://www.bing.W
Source: JSHRF6iG8A.exe, 00000000.00000002.372683188.000000000569D000.00000004.00000001.sdmp, tmp2A86.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: api.ip.sb

System Summary:

Uses 32bit PE files

Source: JSHRF6iG8A.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Detected potential crypto function

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00408C60		0_2_00408C60
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0040DC11		0_2_0040DC11
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00407C3F		0_2_00407C3F
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00418CCC		0_2_00418CCC
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00406CA0		0_2_00406CA0
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_004028B0		0_2_004028B0
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0041A4BE		0_2_0041A4BE
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00418244		0_2_00418244
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00401650		0_2_00401650
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00402F20		0_2_00402F20
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_004193C4		0_2_004193C4
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00418788		0_2_00418788
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00402F89		0_2_00402F89
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00402B90		0_2_00402B90
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_004073A0		0_2_004073A0
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB2B00		0_2_02BB2B00
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB18A0		0_2_02BB18A0
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB7856		0_2_02BB7856

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: String function: 0040E1D8 appears 44 times

Sample file is different than original file name gathered from version info

Source: JSHRF6iG8A.exe	Binary or memory string: OriginalFilename vs JSHRF6iG8A.exe
Source: JSHRF6iG8A.exe, 00000000.00000002.368448048.0000000002BB0000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameSliprail.exe4 vs JSHRF6iG8A.exe
Source: JSHRF6iG8A.exe, 00000000.00000002.369773109.0000000004A30000.00000004.00020000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs JSHRF6iG8A.exe

Sample is known by Antivirus

Source: JSHRF6iG8A.exe	Virustotal: Detection: 32%
Source: JSHRF6iG8A.exe	ReversingLabs: Detection: 50%

PE file has an executable .text section and no other executable section

Source: JSHRF6iG8A.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\JSHRF6iG8A.exe 'C:\Users\user\Desktop\JSHRF6iG8A.exe'
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Creates files inside the user directory

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE24.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/25@2/1

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6284:120:WilError_01

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Might use command line arguments

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Command line argument: 08A

0_2_00413780

Reads the hosts file

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: JSHRF6iG8A.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: JSHRF6iG8A.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: JSHRF6iG8A.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: JSHRF6iG8A.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: JSHRF6iG8A.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: JSHRF6iG8A.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: JSHRF6iG8A.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: _.pdb source: JSHRF6iG8A.exe, 00000000.00000002.369773109.0000000004A30000.00000004.00020000.sdmp
Source:	Binary string: C:\nahamuwozimaxo\rakegapapuhof.pdb source: JSHRF6iG8A.exe
Source:	Binary string: 3KOC:\nahamuwozimaxo\rakegapapuhof.pdb source: JSHRF6iG8A.exe

PE file contains a valid data directory to section mapping

Source: JSHRF6iG8A.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: JSHRF6iG8A.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: JSHRF6iG8A.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: JSHRF6iG8A.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: JSHRF6iG8A.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Unpacked PE file: 0.2.JSHRF6iG8A.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Unpacked PE file: 0.2.JSHRF6iG8A.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0041C40C push cs; iretd		0_2_0041C4E2
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0040981F push 2A10B114h; retf		0_2_00409832
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_004098A4 push 2A10B114h; retf		0_2_004098C2
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00423149 push eax; ret		0_2_00423179
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0041C50E push cs; iretd		0_2_0041C4E2
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00409927 push 2A10B114h; retf		0_2_0040993A
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_004231C8 push eax; ret		0_2_00423179
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00409998 push 2A10B114h; retf		0_2_004099B6
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00409A1B push 2A10B114h; retf		0_2_00409A2E
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0040E21D push ecx; ret		0_2_0040E230
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0041C6BE push ebx; ret		0_2_0041C6BF
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00409702 push 2A10B114h; retf		0_2_00409720
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0040979C push 2A10B114h; retf		0_2_004097BA
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB9AF4 push 2A10B114h; retf		0_2_02BB9B12
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB9A6F push 2A10B114h; retf		0_2_02BB9A82
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB9BE8 push 2A10B114h; retf		0_2_02BB9C06
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB9B77 push 2A10B114h; retf		0_2_02BB9B8A
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BB99EC push 2A10B114h; retf		0_2_02BB9A0A

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe TID: 6092	Thread sleep time: -6456360425798339s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe TID: 5948	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe TID: 4616	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Is looking for software installed on the system

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Window / User API: threadDelayed 1868			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Window / User API: threadDelayed 5211			Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Queries a list of all running processes

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Process information queried: ProcessInformation

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040CE09

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree,

0_2_0040ADB0

Enables debug privileges

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_02BB092B mov eax, dword ptr fs:[00000030h]

0_2_02BB092B

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Memory allocated: page read and write | page guard

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0040CE09
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0040E61C
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00416F6A
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_004123F1 SetUnhandledExceptionFilter,		0_2_004123F1
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BBE86C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_02BBE86C
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BBD059 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_02BBD059
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Code function: 0_2_02BC71BA __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_02BC71BA

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: GetLocaleInfoA,

0_2_00417A20

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe

Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412A15

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

AV process strings found (often used to terminate AV products)

Source: JSHRF6iG8A.exe, 00000000.00000002.378534986.000000000A4F0000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4c98e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.JSHRF6iG8A.exe.2d9b618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4e00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.JSHRF6iG8A.exe.2d9b618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4d876.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4d876.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4c98e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4e00000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.372796000.00000000061E5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.370613149.0000000004E00000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.369773109.0000000004A30000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.291845822.0000000002D9B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.370541857.0000000004C0C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JSHRF6iG8A.exe PID: 4036, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\Desktop\JSHRF6iG8A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Remote Access Functionality:

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4c98e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.JSHRF6iG8A.exe.2d9b618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4e00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.JSHRF6iG8A.exe.2d9b618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4d876.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4d876.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4a30ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4c4c98e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JSHRF6iG8A.exe.4e00000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.372796000.00000000061E5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.370613149.0000000004E00000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.369773109.0000000004A30000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.291845822.0000000002D9B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.370541857.0000000004C0C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JSHRF6iG8A.exe PID: 4036, type: MEMORYSTR