Windows Analysis Report 2i85zGtHIl.exe

AV Detection:

Found malware configuration

Source: 2.2.2i85zGtHIl.exe.7a0000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.150.67.151:31440"], "Bot Id": "svech2"}

Multi AV Scanner detection for submitted file

Source: 2i85zGtHIl.exe

Virustotal: Detection: 44%

Perma Link

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A3CAB8 CryptUnprotectData,		2_2_06A3CAB8
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A3D268 CryptUnprotectData,		2_2_06A3D268

Compliance:

Uses 32bit PE files

Source: 2i85zGtHIl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 2i85zGtHIl.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49750 -> 45.150.67.151:31440

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ASDETUKhttpwwwheficedcomGB ASDETUKhttpwwwheficedcomGB

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151
Source: unknown	TCP traffic detected without corresponding DNS query: 45.150.67.151

Found strings which match to known social media urls

Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp

String found in binary or memory: Ji9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp

String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

URLs found in memory or binary data

Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: 2i85zGtHIl.exe, 00000002.00000003.327692175.000000000112B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000003.327726207.000000000112C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/Ident
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 2i85zGtHIl.exe, 00000002.00000002.329755939.0000000002E1D000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14V
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.328969662.0000000002A91000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 2i85zGtHIl.exe, 00000002.00000002.330470320.0000000003D0A000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329403565.0000000002CC2000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329604363.0000000002D83000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.330583634.0000000003D7B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2i85zGtHIl.exe	String found in binary or memory: https://api.ip.sb/ip
Source: 2i85zGtHIl.exe, 00000002.00000002.330470320.0000000003D0A000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329403565.0000000002CC2000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329604363.0000000002D83000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.330583634.0000000003D7B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2i85zGtHIl.exe, 00000002.00000002.330470320.0000000003D0A000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329403565.0000000002CC2000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329604363.0000000002D83000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.330583634.0000000003D7B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabLW
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 2i85zGtHIl.exe, 00000002.00000002.330470320.0000000003D0A000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329403565.0000000002CC2000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329604363.0000000002D83000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.330583634.0000000003D7B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 2i85zGtHIl.exe, 00000002.00000002.330470320.0000000003D0A000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329403565.0000000002CC2000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329604363.0000000002D83000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.330583634.0000000003D7B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329956845.0000000002F5E000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 2i85zGtHIl.exe, 00000002.00000002.330470320.0000000003D0A000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329665099.0000000002D99000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329403565.0000000002CC2000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329604363.0000000002D83000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.330583634.0000000003D7B000.00000004.00000001.sdmp, 2i85zGtHIl.exe, 00000002.00000002.329465463.0000000002CD8000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: 2i85zGtHIl.exe, 00000002.00000002.328307952.0000000000EA0000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Uses 32bit PE files

Source: 2i85zGtHIl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Sample file is different than original file name gathered from version info

Source: 2i85zGtHIl.exe, 00000002.00000002.327947704.00000000007BC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDare.exe4 vs 2i85zGtHIl.exe
Source: 2i85zGtHIl.exe, 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs 2i85zGtHIl.exe
Source: 2i85zGtHIl.exe, 00000002.00000002.328307952.0000000000EA0000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 2i85zGtHIl.exe
Source: 2i85zGtHIl.exe	Binary or memory string: OriginalFilenameDare.exe4 vs 2i85zGtHIl.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_0291EC28		2_2_0291EC28
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A37FB0		2_2_06A37FB0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A30FC8		2_2_06A30FC8
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A32CF0		2_2_06A32CF0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A39B78		2_2_06A39B78
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A3BD90		2_2_06A3BD90
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C09E28		2_2_06C09E28
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C094D0		2_2_06C094D0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C02210		2_2_06C02210
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C094C0		2_2_06C094C0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C09A6D		2_2_06C09A6D
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C073A0		2_2_06C073A0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C073B0		2_2_06C073B0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C018D8		2_2_06C018D8
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C011C0		2_2_06C011C0
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C011B0		2_2_06C011B0

Sample is known by Antivirus

Source: 2i85zGtHIl.exe

Virustotal: Detection: 44%

PE file has an executable .text section and no other executable section

Source: 2i85zGtHIl.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Creates files inside the user directory

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Classification label

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@1/1@0/1

PE file contains a COM descriptor data directory

Source: 2i85zGtHIl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 2i85zGtHIl.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 2i85zGtHIl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_02913C78 push esp; iretd		2_2_02913C91
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A3F470 push es; ret		2_2_06A3F480
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06A3FE70 push es; ret		2_2_06A3FE80
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C08F80 push es; ret		2_2_06C08F90
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Code function: 2_2_06C0A720 push es; ret		2_2_06C0A730

Binary contains a suspicious time stamp

Source: 2i85zGtHIl.exe

Static PE information: 0xA3CD4B7B [Wed Jan 31 04:20:11 2057 UTC]

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Is looking for software installed on the system

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Window / User API: threadDelayed 1546			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Window / User API: threadDelayed 3021			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\2i85zGtHIl.exe TID: 6820	Thread sleep time: -8301034833169293s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe TID: 6464	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Queries a list of all running processes

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Process information queried: ProcessInformation

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: 2i85zGtHIl.exe, 00000002.00000003.322352331.0000000000F8E000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: 2i85zGtHIl.exe, 00000002.00000003.322352331.0000000000F8E000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwarePS3YOS4OWin32_VideoControllerEZAEU5YOVideoController120060621000000.000000-000421030.8display.infMSBDAOHY669F1PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors2T99N1A6
Source: 2i85zGtHIl.exe, 00000002.00000002.328392107.0000000000EE0000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Users\user\Desktop\2i85zGtHIl.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\2i85zGtHIl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: 2i85zGtHIl.exe, 00000002.00000002.328480545.0000000000F75000.00000004.00000020.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2i85zGtHIl.exe, type: SAMPLE
Source: Yara match	File source: 2.2.2i85zGtHIl.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.2i85zGtHIl.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.327925997.00000000007A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.275405145.00000000007A2000.00000002.00020000.sdmp, type: MEMORY

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: Ji1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: Ji-cjelfplplebdjjenllpjcblmjkfcffne|JaxxxLiberty
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: 2i85zGtHIl.exe, 00000002.00000002.329261179.0000000002BE7000.00000004.00000001.sdmp	String found in binary or memory: Ji5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2i85zGtHIl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\Desktop\2i85zGtHIl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 00000002.00000002.329114422.0000000002B20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2i85zGtHIl.exe PID: 4972, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2i85zGtHIl.exe, type: SAMPLE
Source: Yara match	File source: 2.2.2i85zGtHIl.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.2i85zGtHIl.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.327925997.00000000007A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.275405145.00000000007A2000.00000002.00020000.sdmp, type: MEMORY