Edit tour

Windows Analysis Report
RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Overview

General Information

Sample name:	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Analysis ID:	1463997
MD5:	0b57430159e81d152455d3d2936f44e0
SHA1:	245c53304354ad8c703b2dd4fce1cc1ec46573bb
SHA256:	bea6547e13a91dea30b43f7b50a6e95d8cbc285c9a2c397fa52d17ce8351cc30
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

RFQ 10046335 PO 4502042346 PR 11148099 411128.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe" MD5: 0B57430159E81D152455D3D2936F44E0)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7640 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7860 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

jsc.exe (PID: 7752 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["195.10.205.102:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1995159842.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe PID: 7576	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: jsc.exe PID: 7752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 7752	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.jsc.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed3996548.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed394b310.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed3996548.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed394b310.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe", ParentImage: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, ParentProcessId: 7576, ParentProcessName: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe", ParentImage: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, ParentProcessId: 7576, ParentProcessName: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, ProcessId: 7640, ProcessName: powershell.exe

Snort Signatures

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 195.10.205.102

Timestamp:	06/28/24-08:47:31.833377
SID:	2043231
Source Port:	49731
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 195.10.205.102 - Destination IP: 192.168.2.4

Timestamp:	06/28/24-08:47:29.500952
SID:	2046056
Source Port:	1912
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.102

Timestamp:	06/28/24-08:47:24.044676
SID:	2046045
Source Port:	49731
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 195.10.205.102 - Destination IP: 192.168.2.4

Timestamp:	06/28/24-08:47:24.248710
SID:	2043234
Source Port:	1912
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.jsc.exe.400000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["195.10.205.102:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Virustotal: Detection: 12%			Perma Link
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push r14	0_2_00007FF65F3DD7E0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rdi	0_2_00007FF65F363D20
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rsi	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rdi	0_2_00007FF65F32DD30
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F2A1C50
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 4x nop then push rbx	0_2_00007FF65F2A1C50

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49731 -> 195.10.205.102:1912
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49731 -> 195.10.205.102:1912
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 195.10.205.102:1912 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 195.10.205.102:1912 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 195.10.205.102:1912

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 195.10.205.102:1912

Source: Joe Sandbox View

ASN Name: TSSCOM-ASRU TSSCOM-ASRU

Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1995159842.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D38B0	0_2_00007FF65F2D38B0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D21B0	0_2_00007FF65F2D21B0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2CC0A0	0_2_00007FF65F2CC0A0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2B2080	0_2_00007FF65F2B2080
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2DE8E0	0_2_00007FF65F2DE8E0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D58C0	0_2_00007FF65F2D58C0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2B3130	0_2_00007FF65F2B3130
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2C17B4	0_2_00007FF65F2C17B4
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F357F40	0_2_00007FF65F357F40
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2ABF90	0_2_00007FF65F2ABF90
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D67E0	0_2_00007FF65F2D67E0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2CC7D0	0_2_00007FF65F2CC7D0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2B3EF0	0_2_00007FF65F2B3EF0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2AB6F0	0_2_00007FF65F2AB6F0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2A6ED0	0_2_00007FF65F2A6ED0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2C1D60	0_2_00007FF65F2C1D60
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2BD620	0_2_00007FF65F2BD620
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2C6C90	0_2_00007FF65F2C6C90
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D5490	0_2_00007FF65F2D5490
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2CBC80	0_2_00007FF65F2CBC80
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2C02A0	0_2_00007FF65F2C02A0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2B9A90	0_2_00007FF65F2B9A90
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2A82D0	0_2_00007FF65F2A82D0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D4B10	0_2_00007FF65F2D4B10
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D71B0	0_2_00007FF65F2D71B0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D29B0	0_2_00007FF65F2D29B0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2B81F0	0_2_00007FF65F2B81F0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2D31E0	0_2_00007FF65F2D31E0
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2A39D0	0_2_00007FF65F2A39D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_00B325D8	4_2_00B325D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_00B3DC74	4_2_00B3DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_05437660	4_2_05437660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_054396C8	4_2_054396C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_0543B170	4_2_0543B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_05436928	4_2_05436928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 4_2_0543B9E8	4_2_0543B9E8

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Code function: String function: 00007FF65F2ADBD0 appears 64 times

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Binary or memory string: OriginalFilename vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000000.1865499941.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSorterObjectArrayNegateSaturate.dll` vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000003.1880665917.0000020ECF0EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSorterObjectArrayNegateSaturate.dll` vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSorterObjectArrayNegateSaturate.dll` vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Binary or memory string: OriginalFilenameSorterObjectArrayNegateSaturate.dll` vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	Binary or memory string: OriginalFilenameSorterObjectArrayNegateSaturate.dll` vs RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: Section: .rsrc ZLIB complexity 0.9971849173553718
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9971849173553718

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/8@0/1

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Code function: 0_2_00007FF65F2B2F60 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF65F2B2F60

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

File created: C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cc2dcv04.rrt.ps1

Jump to behavior

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Virustotal: Detection: 12%
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

File read: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe "C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe"
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Static file information: File size 2440192 > 1048576

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: section name: .managed
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Static PE information: section name: hydrated
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	Static PE information: section name: .managed
Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	Static PE information: section name: hydrated

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	File created: \rfq 10046335 po 4502042346 pr 11148099 411128.exe
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	File created: \rfq 10046335 po 4502042346 pr 11148099 411128.exe
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	File created: \rfq 10046335 po 4502042346 pr 11148099 411128.exe
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	File created: \rfq 10046335 po 4502042346 pr 11148099 411128.exe	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	File created: \rfq 10046335 po 4502042346 pr 11148099 411128.exe	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

File created: C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Jump to dropped file

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

File created: C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

File created: C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Memory allocated: 20ECF1A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6543	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3182	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 669	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 2081	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-16182

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8072	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Code function: 0_2_00007FF65F2B2B90 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF65F2B2B90

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: jsc.exe, 00000004.00000002.2003410185.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F2A8130 RtlAddVectoredExceptionHandler,RaiseFailFastException,		0_2_00007FF65F2A8130
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Code function: 0_2_00007FF65F30B70C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF65F30B70C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 682008	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Code function: 0_2_00007FF65F30BDA4 cpuid

0_2_00007FF65F30BDA4

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Code function: GetLocaleInfoEx,

0_2_00007FF65F370D30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Code function: 0_2_00007FF65F2AEB00 GetSystemTimeAsFileTime,

0_2_00007FF65F2AEB00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed3996548.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed394b310.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed3996548.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed394b310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1995159842.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7752, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7752, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed3996548.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed394b310.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed3996548.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.20ed394b310.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1995159842.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 10046335 PO 4502042346 PR 11148099 411128.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7752, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	111 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	11 Disable or Modify Tools	LSASS Memory	321 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	311 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	135 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	12%	Virustotal		Browse
RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	39%	ReversingLabs	Win64.Spyware.RedLine

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	39%	ReversingLabs	Win64.Spyware.RedLine

Source	Detection	Scanner	Label	Link
http://tempuri.org/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Virustotal		Browse
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9	3%	Virustotal		Browse
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibility	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Virustotal		Browse
https://aka.ms/nativeaot-compatibility	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibilityy	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1995159842.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityy	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/nativeaot-compatibilityY	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe, RFQ 10046335 PO 4502042346 PR 11148099 411128.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-c	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	jsc.exe, 00000004.00000002.1996982292.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	jsc.exe, 00000004.00000002.1996982292.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtabS	jsc.exe, 00000004.00000002.1996982292.0000000002F38000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000004.00000002.1996982292.0000000002EA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	jsc.exe, 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.10.205.102	unknown	Russian Federation		35813	TSSCOM-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1463997
Start date and time:	2024-06-28 08:46:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/8@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:47:21	API Interceptor	19x Sleep call for process: powershell.exe modified
02:47:29	API Interceptor	15x Sleep call for process: jsc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TSSCOM-ASRU	sWXyzk4Kv3.exe	Get hash	malicious	AsyncRAT	Browse	195.10.205.90
	SecuriteInfo.com.Win32.TrojanX-gen.9663.10822.exe	Get hash	malicious	Xmrig	Browse	195.10.205.162
	JCqU250N6g.exe	Get hash	malicious	RedLine	Browse	195.10.205.91
	1f3d6f01961645f.exe	Get hash	malicious	Unknown	Browse	195.10.205.74
	1f3d6f01961645f.exe	Get hash	malicious	Unknown	Browse	195.10.205.74
	Ck5Yckrogl.exe	Get hash	malicious	RedLine	Browse	195.10.205.79
	SD5IYbZmDL.exe	Get hash	malicious	RedLine	Browse	195.10.205.16
	3DmdxH8ksO.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	195.10.205.16
	DjZ61wINTx.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	195.10.205.16
	4e70f9de2a4e122b0ba1db7c63ac443e39bbfd9e2b475.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	195.10.205.16

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cc2dcv04.rrt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duhjypiv.foh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3ymev40.pqy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zkhfamjp.oc5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Download File

Process:	C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2440192
Entropy (8bit):	7.07799900264123
Encrypted:	false
SSDEEP:	49152:IF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUYeaw1GlNOmTCbCuF:KroA7PxBOb
MD5:	0B57430159E81D152455D3D2936F44E0
SHA1:	245C53304354AD8C703B2DD4FCE1CC1EC46573BB
SHA-256:	BEA6547E13A91DEA30B43F7B50A6E95D8CBC285C9A2C397FA52D17CE8351CC30
SHA-512:	C70103E599A534BD6AAD4238DF567223FC4D2A7B07632BE09C42EA2F46E3C941523EAD3B3EE27ABE72445DED4E33A646421A176D82FAB637B4B500782B629F40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..Ec...c...c....v..j....v..n....v..M...j.D.m...(...h...c...n....w..k....w..b...c...b....w..$...pq..b...pq..b...Richc...................PE..d...2.}f.........."....(......................@..............................+...........`.........................................`.#.X.....#......@&.......%..6............+......f!.T....................h!.(....d!.@............................................text............................... ..`.managed............................ ..`hydrated@................................rdata.............................@..@.data...h.....$......*..............@....pdata...6....%..8...D..............@..@.rsrc........@&......\| .............@..@.reloc........+......6%.............@..B........................................................................................................................................................

C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.07799900264123
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
File size:	2'440'192 bytes
MD5:	0b57430159e81d152455d3d2936f44e0
SHA1:	245c53304354ad8c703b2dd4fce1cc1ec46573bb
SHA256:	bea6547e13a91dea30b43f7b50a6e95d8cbc285c9a2c397fa52d17ce8351cc30
SHA512:	c70103e599a534bd6aad4238df567223fc4d2a7b07632be09c42ea2f46e3c941523ead3b3ee27abe72445ded4e33a646421a176d82fab637b4b500782b629f40
SSDEEP:	49152:IF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUYeaw1GlNOmTCbCuF:KroA7PxBOb
TLSH:	C6B5BD15E3E801A8D877D630CA62A332DBB079961730D58F065DD65A2F73EA19B3F312
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..Ec...c...c....v..j....v..n....v..M...j.D.m...(...h...c...n....w..k....w..b...c...b....w..$...pq..b...pq..b...Richc..........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14006b3dc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x667DA332 [Thu Jun 27 17:36:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	97f00b2383bd4369e5094078fdccae7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F4F7D1F6780h
dec eax
add esp, 28h
jmp 00007F4F7D1F5FC7h
int3
int3
jmp 00007F4F7D1F6AFCh
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F4F7D1F6162h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F4F7D1F6165h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F4F7D1F615Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F4F7D1F6172h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [001D73A9h]
jne 00007F4F7D1F6162h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F4F7D1F6153h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x23ec60	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23ecb8	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x264000	0x4b918	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x250000	0x1368c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2b0000	0x5ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x216600	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x216800	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2164c0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x198000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6fef8	0x70000	dd316bc2c65b1ae399457fdba120fa82	False	0.45282200404575895	data	6.641185225824904	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x71000	0xd9b18	0xd9c00	74b435642e339cdb1b2a678eb60c92d8	False	0.4628401711394948	data	6.464502436229499	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x14b000	0x4c540	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x198000	0xa89e4	0xa8a00	5136a3db5b9bcc5734abe5310647f73e	False	0.48930052353595255	data	6.720923141068736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x241000	0xe668	0x1a00	f7893d3998d6fe23c3c2fd83a455cf8d	False	0.22581129807692307	data	3.2697501080046183	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x250000	0x1368c	0x13800	e5aeded247d82c5d18901a5f5b1c4999	False	0.49800931490384615	data	6.163194359627306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x264000	0x4b918	0x4ba00	eb47f429e2704c0f322922e73df5efeb	False	0.9971849173553718	data	7.998508779194308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2b0000	0x5ec	0x600	22b17bd43d0ff4894ef88b7e105d8348	False	0.5989583333333334	data	5.299377162126531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x264110	0x4b2a4	data	1.0003280541516715
RT_VERSION	0x2af3b4	0x378	data	0.35923423423423423
RT_MANIFEST	0x2af72c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	AdjustTokenPrivileges, CreateWellKnownSid, DeregisterEventSource, DuplicateTokenEx, GetSecurityDescriptorLength, GetTokenInformation, GetWindowsAccountDomainSid, LookupPrivilegeValueW, OpenProcessToken, OpenThreadToken, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteTreeW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExA, RegSetValueExW, RegisterEventSourceW, ReportEventW, RevertToSelf, SetThreadToken
bcrypt.dll	BCryptDestroyKey, BCryptEncrypt, BCryptGenRandom, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptDecrypt, BCryptCloseAlgorithmProvider, BCryptImportKey
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, RaiseException, RtlPcToFileHeader, AllocConsole, CancelThreadpoolIo, CloseHandle, CloseThreadpoolIo, CompareStringEx, CompareStringOrdinal, CopyFileExW, CreateDirectoryW, CreateEventExW, CreateFileW, CreateProcessA, CreateSymbolicLinkW, CreateThreadpoolIo, DeleteCriticalSection, DeleteFileW, DeleteVolumeMountPointW, DeviceIoControl, DuplicateHandle, EnterCriticalSection, EnumCalendarInfoExEx, EnumTimeFormatsEx, ExitProcess, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNLSStringEx, FindNextFileW, FindStringOrdinal, FlushFileBuffers, FormatMessageW, FreeConsole, FreeLibrary, GetCPInfo, GetCalendarInfoEx, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumberEx, GetCurrentThread, GetDynamicTimeZoneInformation, GetEnvironmentVariableW, GetFileAttributesExW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetLocaleInfoEx, GetLogicalDrives, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetOverlappedResult, GetProcAddress, GetStdHandle, GetSystemDirectoryW, GetSystemTime, GetThreadPriority, GetTickCount64, GetTimeZoneInformation, GetUserPreferredUILanguages, GetVolumeInformationW, InitializeConditionVariable, InitializeCriticalSection, IsDebuggerPresent, LCMapStringEx, LeaveCriticalSection, LoadLibraryExW, LocalAlloc, LocalFree, LocaleNameToLCID, MoveFileExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseFailFastException, ReadFile, RemoveDirectoryW, ReplaceFileW, ResetEvent, ResolveLocaleName, ResumeThread, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetLastError, SetThreadErrorMode, SetThreadPriority, Sleep, SleepConditionVariableCS, StartThreadpoolIo, SystemTimeToFileTime, TzSpecificLocalTimeToSystemTime, VirtualAlloc, VirtualFree, WaitForMultipleObjectsEx, WakeConditionVariable, WideCharToMultiByte, WriteFile, FlushProcessWriteBuffers, WaitForSingleObjectEx, RtlVirtualUnwind, RtlCaptureContext, RtlRestoreContext, VerSetConditionMask, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, CreateThread, GetCurrentThreadId, SuspendThread, GetThreadContext, SetThreadContext, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, VerifyVersionInfoW, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, VirtualQuery, GetSystemTimeAsFileTime, InitializeCriticalSectionEx, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RtlUnwindEx, InitializeSListHead, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlLookupFunctionEntry
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, CoWaitForMultipleHandles, CoInitializeEx, CoCreateGuid, CoGetApartmentType
USER32.dll	LoadStringW
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, floor, pow, modf, sin, cos, ceil, tan
api-ms-win-crt-heap-l1-1-0.dll	free, calloc, _set_new_mode, malloc, _callnewh
api-ms-win-crt-string-l1-1-0.dll	strncpy_s, strcpy_s, _stricmp, wcsncmp, strcmp
api-ms-win-crt-convert-l1-1-0.dll	strtoull
api-ms-win-crt-runtime-l1-1-0.dll	_register_thread_local_exe_atexit_callback, _c_exit, _cexit, __p___wargv, __p___argc, _exit, exit, _initterm_e, terminate, _crt_atexit, _initterm, _register_onexit_function, _get_initial_wide_environment, abort, _initialize_onexit_table, _initialize_wide_environment, _configure_wide_argv, _seh_filter_exe, _set_app_type
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsscanf, __p__commode, __acrt_iob_func, __stdio_common_vfprintf, __stdio_common_vsprintf_s, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Exports

Name	Ordinal	Address
DotNetRuntimeDebugHeader	1	0x140241d50

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/28/24-08:47:31.833377	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49731	1912	192.168.2.4	195.10.205.102
06/28/24-08:47:29.500952	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	1912	49731	195.10.205.102	192.168.2.4
06/28/24-08:47:24.044676	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49731	1912	192.168.2.4	195.10.205.102
06/28/24-08:47:24.248710	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1912	49731	195.10.205.102	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 28, 2024 08:47:23.101418972 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:23.106427908 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:23.109050035 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:23.118577003 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:23.123532057 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:23.777523041 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:23.824374914 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:24.044676065 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:24.050185919 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:24.248709917 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:24.293123960 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:29.296793938 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:29.301635027 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.500952005 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.500981092 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.500998020 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.501013041 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.501028061 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.501035929 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:29.501055002 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:29.501131058 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.785341978 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.791244030 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.791380882 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.791551113 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.791610003 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.791652918 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.791666985 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.791713953 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.791954994 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.792009115 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.792021990 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.792028904 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.792035103 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.792052984 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.792066097 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.792069912 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.792108059 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.796566010 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.796590090 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.796641111 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.796647072 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.796653986 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.796694040 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.796711922 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.796762943 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.796839952 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.796912909 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.797327995 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.797414064 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.797467947 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.797530890 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.801944971 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802005053 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802182913 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802264929 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802270889 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802324057 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802412033 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802473068 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802484035 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802496910 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802544117 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802584887 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802598000 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802611113 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802642107 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802650928 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802654028 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802665949 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802704096 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802751064 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802762985 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802850008 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802854061 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.802862883 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802875042 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.802911043 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.804439068 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.804451942 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.804464102 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.804774046 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807244062 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807320118 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807332993 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807343006 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807344913 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807367086 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807372093 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807379007 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807396889 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807411909 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807425022 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807456017 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807461023 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807590008 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807602882 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807614088 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807615042 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807629108 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807631969 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807651043 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807661057 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807662964 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807674885 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807706118 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807713985 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.807718039 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807766914 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807780027 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807791948 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807815075 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807826996 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807838917 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807877064 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807889938 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807902098 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807915926 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807928085 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807985067 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.807997942 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808010101 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808104038 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808123112 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808239937 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808253050 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808264971 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808312893 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808326006 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808336973 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808358908 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808372021 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808382988 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808394909 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808408976 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808491945 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808505058 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808516979 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808537006 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808552980 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808573008 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808573961 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.808585882 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808598042 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808609962 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808633089 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808643103 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.808645964 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808657885 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808789015 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808800936 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808811903 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808824062 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808836937 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.808847904 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.809695959 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812027931 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812081099 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812093019 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812112093 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812135935 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812149048 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812160969 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812172890 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812186956 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812206984 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812310934 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812323093 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812345028 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812357903 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812411070 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812423944 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.812438011 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813184977 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813278913 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813395023 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813462973 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813474894 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813487053 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813508034 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813519955 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813571930 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813585043 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813596964 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813625097 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813637018 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813648939 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813672066 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813684940 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813697100 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813716888 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813730955 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813743114 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813764095 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813776970 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813788891 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813821077 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813854933 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.813885927 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813915014 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.813967943 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.813981056 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814008951 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814021111 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814033031 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814044952 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814059019 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814069986 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814104080 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814116001 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814126968 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814147949 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814160109 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814172983 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814445019 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814450026 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814455032 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814523935 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814536095 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814548016 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814569950 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814583063 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814599991 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814611912 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814624071 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814635038 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814657927 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814676046 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814688921 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814709902 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814722061 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814733982 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814929008 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814941883 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814953089 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814965963 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814976931 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.814989090 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.815078974 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.815080881 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.815093040 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.815104961 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.815116882 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818759918 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818772078 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818784952 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818797112 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818820000 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818831921 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818854094 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818866014 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818907976 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818934917 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.818941116 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818988085 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.818996906 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.819000959 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819041014 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819055080 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819067955 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819081068 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819092989 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819104910 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819118977 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819130898 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819142103 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819154024 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819165945 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819178104 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819227934 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819240093 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819251060 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819262981 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819284916 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819297075 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819308996 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819320917 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819333076 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819344044 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819355965 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819367886 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819380999 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819394112 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819405079 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819427013 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819438934 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819504023 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819515944 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819542885 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819555998 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819566965 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819578886 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819591045 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819665909 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819678068 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.819689035 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.820856094 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.820868969 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.823971987 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824136972 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.824146986 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824160099 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824208975 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824213028 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.824280977 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824292898 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824315071 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824326992 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824338913 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824351072 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824362993 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824393034 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824405909 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824433088 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824445009 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824505091 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824517012 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824528933 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824542999 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824594021 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824635029 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824675083 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824687958 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824733973 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824747086 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824765921 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824780941 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824794054 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824805021 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824824095 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824892998 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824904919 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.824915886 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825223923 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825243950 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825256109 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825269938 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825283051 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825294018 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825306892 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825318098 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825330019 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825344086 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825355053 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825366974 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825377941 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825391054 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825402021 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825413942 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825424910 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825437069 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825592041 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.825603962 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.828985929 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.828999043 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829102993 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829114914 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829127073 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829138041 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829171896 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829185009 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829262972 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829274893 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829294920 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829308987 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829323053 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829377890 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829384089 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.829391003 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829402924 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829452038 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829454899 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.829464912 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829477072 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829488993 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829500914 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829514980 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829546928 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829585075 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829622030 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829668045 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829679966 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829691887 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829705000 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829751015 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829762936 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829773903 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829787016 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829808950 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829823971 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829854965 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829866886 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829889059 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829957008 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829969883 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829982042 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.829994917 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830029964 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830041885 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830054045 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830070972 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830075979 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830117941 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830130100 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830141068 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830162048 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830173969 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.830188036 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834331989 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834343910 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834356070 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834389925 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834402084 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834450006 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834462881 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834476948 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834558964 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834572077 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834583998 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834608078 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.834614038 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834625959 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834638119 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834661961 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834675074 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.834676027 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834687948 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834702015 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834733009 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834744930 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834755898 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834779024 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834790945 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834868908 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834913969 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834927082 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834966898 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834971905 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834983110 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.834995031 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.835006952 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.835028887 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.835040092 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.835052013 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.877223969 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.877429962 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.877530098 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.877530098 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.877573967 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.882464886 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882515907 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882529020 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882543087 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882555008 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882566929 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882596970 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882608891 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882631063 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882642031 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882654905 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882666111 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882678986 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882694006 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882709026 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882733107 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882746935 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882759094 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882805109 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882817984 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882829905 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882842064 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882853031 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882865906 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.882877111 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.925144911 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:30.925381899 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:30.977224112 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:31.832619905 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:31.833376884 CEST	49731	1912	192.168.2.4	195.10.205.102
Jun 28, 2024 08:47:31.838313103 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:32.037343979 CEST	1912	49731	195.10.205.102	192.168.2.4
Jun 28, 2024 08:47:32.071404934 CEST	49731	1912	192.168.2.4	195.10.205.102

Target ID:	0
Start time:	02:47:18
Start date:	28/06/2024
Path:	C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe"
Imagebase:	0x7ff65f2a0000
File size:	2'440'192 bytes
MD5 hash:	0B57430159E81D152455D3D2936F44E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1885755676.0000020ED3916000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:47:18
Start date:	28/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:47:19
Start date:	28/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:47:19
Start date:	28/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:47:19
Start date:	28/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x4c0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.1995159842.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.1996982292.0000000002936000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:47:23
Start date:	28/06/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.4%
Total number of Nodes:	978
Total number of Limit Nodes:	28

Executed Functions

Function 00007FF65F2B2B90 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2B9F
GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2BDD
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2C09
GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2C1A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2C29
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2CC0
GetProcessAffinityMask.KERNEL32 ref: 00007FF65F2B2CD3

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 4c9e7b62ca1d93063124db9da2326d3f3828c88f021132ba50495a9616bc8b52
Instruction ID: 8bdaea054c69ba259bbf63517628004378daed328d42c6811354087e4ed3886b
Opcode Fuzzy Hash: 4c9e7b62ca1d93063124db9da2326d3f3828c88f021132ba50495a9616bc8b52
Instruction Fuzzy Hash: 6E515AB2A18B4686EB51CF59E5041B963A2FB48780F8C4431DA4DE73E6EF3CE545CB01

Function 00007FF65F2A8130 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65F2AD0F0: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF65F2A813F,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2AD0FB
Part of subcall function 00007FF65F2AD0F0: QueryInformationJobObject.KERNEL32 ref: 00007FF65F2AD1CE

Part of subcall function 00007FF65F2ACE80: GetModuleHandleExW.KERNEL32(?,?,?,?,00007FF65F2A8168,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2ACE91

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF65F2A81C9
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2A82B3

Strings

StressLogLevel, xrefs: 00007FF65F2A8225
The required instruction sets are not supported by the current CPU., xrefs: 00007FF65F2A829F
TotalStressLogSize, xrefs: 00007FF65F2A81EA

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Exception$AllocFailFastHandleHandlerInformationModuleObjectQueryRaiseVectored
String ID: The required instruction sets are not supported by the current CPU.$StressLogLevel$TotalStressLogSize
API String ID: 2052584837-2841289747
Opcode ID: d0ac9821fb6c0add4b9ebbe98daa48ccbd8c985c351c2d863065a78766f66ba6
Instruction ID: 849a2ec5a78b9a7fe721a1b0e128b58cce2593962d4dd7c8eda40bf7eaae07d3
Opcode Fuzzy Hash: d0ac9821fb6c0add4b9ebbe98daa48ccbd8c985c351c2d863065a78766f66ba6
Instruction Fuzzy Hash: FB4140B2E08A8341EB10ABA19A112FA63D1AF41784F4C4431E9CDB7A9BDFACF445C701

Function 00007FF65F30BDA4 Relevance: 3.2, APIs: 2, Instructions: 199
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF65F30B4B9,?,?,?,?,00007FF65F2AE7A1,?,?,?,00007FF65F2AED24,00000000,00000020,?), ref: 00007FF65F30BDBE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65F30BDD4

Part of subcall function 00007FF65F30C204: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF65F30C20D

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: bf961b2ab8b72b6bb4696f625dc9e1acb4f646454a2333270e2ccd61e10cc9a7
Instruction ID: 71463b96c90df93166cc6c63d3a51067d7bd3fd5aa3c95074c7d73f0fa7c4144
Opcode Fuzzy Hash: bf961b2ab8b72b6bb4696f625dc9e1acb4f646454a2333270e2ccd61e10cc9a7
Instruction Fuzzy Hash: D9819E71E086039AF758CF29A85126937E4FB143A4F18473ADA6DEB7E1CF7CA5408740

Function 00007FF65F370D30 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,00000010,0000020ED0C002C0,?,?,00000000,?,?,00007FF65F33E953), ref: 00007FF65F370D86

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 204640446f1087154f6338ca72d232791813a4a0625229ff24d57606c327cb8e
Instruction ID: 02dee8a99a57b437ffa133fe0c6b6d75cbae02a3f0d8aaceba0cb67298e56ebe
Opcode Fuzzy Hash: 204640446f1087154f6338ca72d232791813a4a0625229ff24d57606c327cb8e
Instruction Fuzzy Hash: E1011373B09B1099FB11DAB5AC014EE3BB8B758318B54413AEE4DA7A48EF34A452C640

Function 00007FF65F2D38B0 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 08012919a8b1b8081b4c713736aa929bcbe064cfab43f142deed8e71929d45e1
Instruction ID: 1fd377f7e1a59227fb4cea89fe98252fd2fc4b2fcd532c293f4d7c1d1574ad48
Opcode Fuzzy Hash: 08012919a8b1b8081b4c713736aa929bcbe064cfab43f142deed8e71929d45e1
Instruction Fuzzy Hash: 9802CFA1E4964786FB15CB69E94063477A2BF54780F0C8636D64DF72A2DF3CB982C701

Function 00007FF65F2D21B0 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6522dfba86e506d4cce0a791ffe426ab58007ea9c2e4f0f8ba7e2c60a8adf3
Instruction ID: 44eee595bc87b828ad235b2496e86ccdad4f704fbe4e182faa28b594f1e8547c
Opcode Fuzzy Hash: da6522dfba86e506d4cce0a791ffe426ab58007ea9c2e4f0f8ba7e2c60a8adf3
Instruction Fuzzy Hash: 91F1BE61D1DB4346FB52DB64EA1127463A1AFA6380F0D8736EA4DF22A7EF2C74D18701

Function 00007FF65F2B2750 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65F2B278C
IsProcessInJob.KERNEL32 ref: 00007FF65F2B279C
QueryInformationJobObject.KERNEL32 ref: 00007FF65F2B27CC
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF65F2B283E
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF65F2B2879
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF65F2B28C0

Strings

@, xrefs: 00007FF65F2B28B5
@, xrefs: 00007FF65F2B286E
@, xrefs: 00007FF65F2B2826

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: 46198da623394d7b15bb719f5e4a5128e58e6380a5aeb4f160e59a8db540b038
Instruction ID: b47af6881a7d3efcc3ab5cb1301ef36b594fadc2faaf8327a2d6cee7c8e578ac
Opcode Fuzzy Hash: 46198da623394d7b15bb719f5e4a5128e58e6380a5aeb4f160e59a8db540b038
Instruction Fuzzy Hash: 27418472608BC185EB728F51E5043AAB3A0FB84BA0F5C4635DEAD97AD9DF3CD4448B10

Function 00007FF65F2AD0F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF65F2A813F,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2AD0FB

Part of subcall function 00007FF65F2B2B90: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2B9F
Part of subcall function 00007FF65F2B2B90: GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2BDD
Part of subcall function 00007FF65F2B2B90: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2C09
Part of subcall function 00007FF65F2B2B90: GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2C1A
Part of subcall function 00007FF65F2B2B90: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F2AD11A), ref: 00007FF65F2B2C29

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF65F2A813F,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2AD16D
GetProcessAffinityMask.KERNEL32 ref: 00007FF65F2AD180
QueryInformationJobObject.KERNEL32 ref: 00007FF65F2AD1CE

Strings

PROCESSOR_COUNT, xrefs: 00007FF65F2AD136

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem
String ID: PROCESSOR_COUNT
API String ID: 1701933505-4048346908
Opcode ID: 25420fbf59497c97a6a616538860f2c47e8523c816d87657a417c9793d34a5e2
Instruction ID: 33e7e78919a77006d14d16aa54ff9db682a2d168153600c05fac047a3f534452
Opcode Fuzzy Hash: 25420fbf59497c97a6a616538860f2c47e8523c816d87657a417c9793d34a5e2
Instruction Fuzzy Hash: 8A3193A1A0CA4386FB149B94D9403B9A3E1EF84354F980431DA8DE76DADF6CE449C710

Function 00007FF65F2A3630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF65F36F880), ref: 00007FF65F2A36D5
RaiseFailFastException.KERNEL32(?,?,?,00007FF65F36F880), ref: 00007FF65F2A3701
RaiseFailFastException.KERNEL32(?,?,?,00007FF65F36F880), ref: 00007FF65F2A373A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 00007FF65F2A3726

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: 6d8d11b0511a8dae8a9ce044f43be3adb427a5065ca878d9ad955d00c565f2fa
Instruction ID: ae508a077f19e7bd33f72d9986cdc23be727332210c0fb17792d8fc806aac30b
Opcode Fuzzy Hash: 6d8d11b0511a8dae8a9ce044f43be3adb427a5065ca878d9ad955d00c565f2fa
Instruction Fuzzy Hash: 15413B72A58A4282FB90DF55EA5037933E0EB04B84F0C5039CA8DE67A5DF7EE855C741

Function 00007FF65F2AD350 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00007FF65F2AD371
SetThreadPriority.KERNELBASE ref: 00007FF65F2AD38D
ResumeThread.KERNELBASE ref: 00007FF65F2AD396
FindCloseChangeNotification.KERNELBASE ref: 00007FF65F2AD39F

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Thread$ChangeCloseCreateFindNotificationPriorityResume
String ID:
API String ID: 2150560229-0
Opcode ID: 1fd97627cfe8389e38b2286a366fd33d3ebac3e1f7f8eb4fcf4620db7d9795ed
Instruction ID: 0d12fe2462e8afe0a94b8b9d63933cefd72b6b33062c0bdee8d399c72f65de69
Opcode Fuzzy Hash: 1fd97627cfe8389e38b2286a366fd33d3ebac3e1f7f8eb4fcf4620db7d9795ed
Instruction Fuzzy Hash: F2E092A6E1970282FB159F61B82837AA360BF98B85F4C4034DD8F563E1EF3D91958704

Function 00007FF65F2B2570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65F2B25A7
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF65F2B266C

Strings

@, xrefs: 00007FF65F2B2664

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: d415d27f6ddf2cca45eba18734769ddeecb613225847b9f00db101291d5e82da
Instruction ID: 904b5edb3021b6cf38e637cc4ed645b2174cc6e903e241324539b899d6b17381
Opcode Fuzzy Hash: d415d27f6ddf2cca45eba18734769ddeecb613225847b9f00db101291d5e82da
Instruction Fuzzy Hash: F241B4A1A19B4641EA57CB76D21033997926F5ABC0F1CCB31DE4EB6784FF3CE4818A00

Function 00007FF65F2B8DCB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00007FF65F2B8E2E
GetTickCount64.KERNEL32 ref: 00007FF65F2B8EB3

Strings

D), xrefs: 00007FF65F2B8F57

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Count64Tick
String ID: D)
API String ID: 1927824332-848725745
Opcode ID: f82d4a9a810ac6d4e96cf24114986ca43aa22862ede0ef90aa7aa3fe145d4e2e
Instruction ID: 76330d5432f59c025eabbdc44b0015684ed8e9cad2f9b7170e9157cbb363f75b
Opcode Fuzzy Hash: f82d4a9a810ac6d4e96cf24114986ca43aa22862ede0ef90aa7aa3fe145d4e2e
Instruction Fuzzy Hash: DC4182B1E0974785FB65CBA4D6402BA2390AF50784F1D4936DE5DF3B92DE3CE4468302

Function 00007FF65F2B2E10 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,00007FF65F2B6968,?,?,0000000B,00007FF65F2B5830,?,?,00000000,00007FF65F2AFBF1), ref: 00007FF65F2B2E37
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00007FF65F2B6968,?,?,0000000B,00007FF65F2B5830,?,?,00000000,00007FF65F2AFBF1), ref: 00007FF65F2B2E57
VirtualAllocExNuma.KERNEL32 ref: 00007FF65F2B2E78

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 5188d5bc0a99c14dc0d2229a5aba8e7e5169a6da6aec5c86698c49050b78a37c
Instruction ID: 49ea7f10510925756adf4240e5816c52ca9ca07691a96cb0dacdb83f1cfe1f31
Opcode Fuzzy Hash: 5188d5bc0a99c14dc0d2229a5aba8e7e5169a6da6aec5c86698c49050b78a37c
Instruction Fuzzy Hash: A7F0A471B0869182E7208B06F40021AA760AB49BD4F184138EF4C67BA8DF3DD5C18B04

Function 00007FF65F2B2DD0 Relevance: 2.5, APIs: 2, Instructions: 17
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF65F2B2DE6
VirtualFree.KERNELBASE ref: 00007FF65F2B2DFC

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 3b0924aad5c9d8f1e4054d63f84a8e7ac6c370ab154e50dab9d8d9c549d06468
Instruction ID: ff3c5a4ef7ffffcb6e8ffbc53d2748abf1ff186d64e83b8bfd93835808577034
Opcode Fuzzy Hash: 3b0924aad5c9d8f1e4054d63f84a8e7ac6c370ab154e50dab9d8d9c549d06468
Instruction Fuzzy Hash: FBE0C225F1A20182EB18DB13A84666A13916F5DB00FC88038C90D93790EE2DA19B8F40

Function 00007FF65F34CFB0 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(?,?,?,?,00000030,?,?,?,?,?,?,?,00007FF65F34CE70,?,?,00000030), ref: 00007FF65F34D029

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ce31ffd1ec9d8b5bbdb0ed3b55378968654e8df619020ba143fb855d25076bc4
Instruction ID: 207cd58be83318c17f7907891fd597e6d8c70b6e434fb741f765f08ae6bfb463
Opcode Fuzzy Hash: ce31ffd1ec9d8b5bbdb0ed3b55378968654e8df619020ba143fb855d25076bc4
Instruction Fuzzy Hash: CD31B262F0860645FB10EB51A8192BD23A06F44B54F4C4036DE8DAB79ADE6DE886C380

Function 00007FF65F2A2AB0 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65F2ACE60: GetCurrentThreadId.KERNEL32 ref: 00007FF65F2ACE64

Part of subcall function 00007FF65F2AE660: VirtualQuery.KERNEL32 ref: 00007FF65F2AE692

RaiseFailFastException.KERNEL32 ref: 00007FF65F2A2B36

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CurrentExceptionFailFastQueryRaiseThreadVirtual
String ID:
API String ID: 2131581837-0
Opcode ID: 81512a36198997ebbb2f8b2451833254b7240adeb84ca046804f6c980f224bd1
Instruction ID: 78d7b63ab0ffccf604bc9b1bb3cf50580fc61a680b210c5ff37b95ee40807ea4
Opcode Fuzzy Hash: 81512a36198997ebbb2f8b2451833254b7240adeb84ca046804f6c980f224bd1
Instruction Fuzzy Hash: 12115EB2908B8182EB64AF65B4011AAB351F7457B0F584339E6FD9B7D6DF78D0468700

Function 00007FF65F2B2EA0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF65F2B2EAA

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c77d0b216ed602b1f63c297f10537e1da20961e91553004aa9498b52e676b055
Instruction ID: 5f4ff1aed4ea0b5975fc04adfebe9e0a2eb415a4a7d5faa994d545baf78e953d
Opcode Fuzzy Hash: c77d0b216ed602b1f63c297f10537e1da20961e91553004aa9498b52e676b055
Instruction Fuzzy Hash: 5CB01200F1A001C2E30427237C82B0D03142B19B12FC90024C608F1690DD2C81E51B10

Non-executed Functions

Function 00007FF65F2B3130 Relevance: 123.1, Strings: 98, Instructions: 569COMMON

Download Yara Rule

Strings

System.GC.CpuGroup, xrefs: 00007FF65F2B32A8
ConcurrentGC, xrefs: 00007FF65F2B3185
LogFile, xrefs: 00007FF65F2B365F
LatencyLevel, xrefs: 00007FF65F2B342A
System.GC.HeapCount, xrefs: 00007FF65F2B338C
BGCG2RatioStep, xrefs: 00007FF65F2B38ED
BGCFLEnableFF, xrefs: 00007FF65F2B38CF, 00007FF65F2B3A17
GCHeapHardLimitPercent, xrefs: 00007FF65F2B35BE
BGCMemGoal, xrefs: 00007FF65F2B36EF
GCHeapHardLimit, xrefs: 00007FF65F2B359C
System.GC.HeapHardLimitPOH, xrefs: 00007FF65F2B394F
GCEnableSpecialRegions, xrefs: 00007FF65F2B362B
System.GC.NoAffinitize, xrefs: 00007FF65F2B3220
GCNumaAware, xrefs: 00007FF65F2B3287
GCHeapAffinitizeRanges, xrefs: 00007FF65F2B34B2, 00007FF65F2B34D3
GCGen0MaxBudget, xrefs: 00007FF65F2B3533
System.GC.DynamicAdaptationMode, xrefs: 00007FF65F2B3AED
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF65F2B3971
BGCFLki, xrefs: 00007FF65F2B3785
GCSpinCountUnit, xrefs: 00007FF65F2B3ACF
LatencyMode, xrefs: 00007FF65F2B340C
BGCFLEnableKi, xrefs: 00007FF65F2B3857
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF65F2B399B
System.GC.MaxHeapCount, xrefs: 00007FF65F2B33AE
BGCFLEnableSmooth, xrefs: 00007FF65F2B3893
System.GC.HeapHardLimitSOH, xrefs: 00007FF65F2B390B
ConfigLogFile, xrefs: 00007FF65F2B36A3
System.GC.Server, xrefs: 00007FF65F2B314B
System.GC.ConserveMemory, xrefs: 00007FF65F2B39F5
GCName, xrefs: 00007FF65F2B3A3F, 00007FF65F2B3A62
GCHighMemPercent, xrefs: 00007FF65F2B3502
System.GC.RetainVM, xrefs: 00007FF65F2B31DA
BGCFLff, xrefs: 00007FF65F2B37C1
GCRegionRange, xrefs: 00007FF65F2B35EF
CompactRatio, xrefs: 00007FF65F2B3466
GCHeapAffinitizeMask, xrefs: 00007FF65F2B3493
ForceCompact, xrefs: 00007FF65F2B31B9
GCTotalPhysicalMemory, xrefs: 00007FF65F2B35D1
BGCFLSmoothFactor, xrefs: 00007FF65F2B37DF
LOHCompactionMode, xrefs: 00007FF65F2B3310, 00007FF65F2B3350
System.GC.Concurrent, xrefs: 00007FF65F2B3173
LogEnabled, xrefs: 00007FF65F2B3245
System.GC.HeapHardLimit, xrefs: 00007FF65F2B358D
GCCpuGroup, xrefs: 00007FF65F2B32BA
LogFileSize, xrefs: 00007FF65F2B3448
ServerGC, xrefs: 00007FF65F2B315A
GCPath, xrefs: 00007FF65F2B3A8C, 00007FF65F2B3AAF
BGCFLkd, xrefs: 00007FF65F2B37A3
BGCFLkp, xrefs: 00007FF65F2B3767
BGCFLEnableKd, xrefs: 00007FF65F2B3875
GCRegionSize, xrefs: 00007FF65F2B360D
SegmentSize, xrefs: 00007FF65F2B33EE
GCDTargetTCP, xrefs: 00007FF65F2B3B1E
System.GC.LOHThreshold, xrefs: 00007FF65F2B332E
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF65F2B39B5
System.GC.HeapHardLimitPercent, xrefs: 00007FF65F2B35AF
GCGen1MaxBudget, xrefs: 00007FF65F2B3551
Gen0Size, xrefs: 00007FF65F2B33D0
ConfigLogEnabled, xrefs: 00007FF65F2B3266
GCConserveMem, xrefs: 00007FF65F2B3A04
System.GC.Name, xrefs: 00007FF65F2B3A38, 00007FF65F2B3A50
NoAffinitize, xrefs: 00007FF65F2B3232
GCDynamicAdaptationMode, xrefs: 00007FF65F2B3AFC
BGCSpin, xrefs: 00007FF65F2B336E
System.GC.Path, xrefs: 00007FF65F2B3A85, 00007FF65F2B3A9D
BGCFLEnableTBH, xrefs: 00007FF65F2B38B1
BGCFLGradualD, xrefs: 00007FF65F2B37FD
BGCFLSweepGoalLOH, xrefs: 00007FF65F2B3749
System.GC.HighMemoryPercent, xrefs: 00007FF65F2B34F3
HeapVerifyLevel, xrefs: 00007FF65F2B32F2
RetainVM, xrefs: 00007FF65F2B31EC
LOHThreshold, xrefs: 00007FF65F2B333D
GCProvModeStress, xrefs: 00007FF65F2B3515
BGCFLTuningEnabled, xrefs: 00007FF65F2B36D1
HeapCount, xrefs: 00007FF65F2B339B
GCHeapHardLimitSOHPercent, xrefs: 00007FF65F2B3980
System.GC.HeapAffinitizeMask, xrefs: 00007FF65F2B3484
BGCFLSweepGoal, xrefs: 00007FF65F2B372B
MaxHeapCount, xrefs: 00007FF65F2B33BD
BGCMLkp, xrefs: 00007FF65F2B3826
System.GC.HeapHardLimitLOH, xrefs: 00007FF65F2B392D
System.GC.DTargetTCP, xrefs: 00007FF65F2B3B0F
System.GC.HeapAffinitizeRanges, xrefs: 00007FF65F2B34A6, 00007FF65F2B34C7
GCLowSkipRatio, xrefs: 00007FF65F2B356F
BGCMemGoalSlack, xrefs: 00007FF65F2B370D
ConservativeGC, xrefs: 00007FF65F2B3198
GCLogFile, xrefs: 00007FF65F2B364E
GCConfigLogFile, xrefs: 00007FF65F2B3692
GCHeapHardLimitLOH, xrefs: 00007FF65F2B393C
System.GC.LargePages, xrefs: 00007FF65F2B32D8
BGCMLki, xrefs: 00007FF65F2B3839
BreakOnOOM, xrefs: 00007FF65F2B31FF
GCHeapHardLimitLOHPercent, xrefs: 00007FF65F2B39A5
GCEnabledInstructionSets, xrefs: 00007FF65F2B39D7
GCHeapHardLimitSOH, xrefs: 00007FF65F2B391A
GCHeapHardLimitPOHPercent, xrefs: 00007FF65F2B39C4
GCLargePages, xrefs: 00007FF65F2B32E2
GCHeapHardLimitPOH, xrefs: 00007FF65F2B395E

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BreakOnOOM$CompactRatio$ConcurrentGC$ConfigLogEnabled$ConfigLogFile$ConservativeGC$ForceCompact$GCConfigLogFile$GCConserveMem$GCCpuGroup$GCDTargetTCP$GCDynamicAdaptationMode$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapAffinitizeRanges$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLargePages$GCLogFile$GCLowSkipRatio$GCName$GCNumaAware$GCPath$GCProvModeStress$GCRegionRange$GCRegionSize$GCSpinCountUnit$GCTotalPhysicalMemory$Gen0Size$HeapCount$HeapVerifyLevel$LOHCompactionMode$LOHThreshold$LatencyLevel$LatencyMode$LogEnabled$LogFile$LogFileSize$MaxHeapCount$NoAffinitize$RetainVM$SegmentSize$ServerGC$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.DTargetTCP$System.GC.DynamicAdaptationMode$System.GC.HeapAffinitizeMask$System.GC.HeapAffinitizeRanges$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LOHThreshold$System.GC.LargePages$System.GC.MaxHeapCount$System.GC.Name$System.GC.NoAffinitize$System.GC.Path$System.GC.RetainVM$System.GC.Server
API String ID: 0-1379766591
Opcode ID: d99b99d8d7d8079bc8fcfdef839217da97d7cae1de85db9ed7a85a6efaf86363
Instruction ID: da98103661fa897cc1f7428dd9c546de5cce7ee1b75073dbcc25b87f0ed1d337
Opcode Fuzzy Hash: d99b99d8d7d8079bc8fcfdef839217da97d7cae1de85db9ed7a85a6efaf86363
Instruction Fuzzy Hash: 5D427E71A08A5782EF20DB55F850AAD63A5FF887C8F492532DA8C57B66DF3CD206C704

Function 00007FF65F2B3EF0 Relevance: 113.0, Strings: 90, Instructions: 479COMMON

Download Yara Rule

Strings

GCDTargetTCP, xrefs: 00007FF65F2B4A13
System.GC.CpuGroup, xrefs: 00007FF65F2B4099
System.GC.LOHThreshold, xrefs: 00007FF65F2B4144
GCgen0size, xrefs: 00007FF65F2B4220
System.GC.HeapCount, xrefs: 00007FF65F2B41C4
BGCG2RatioStep, xrefs: 00007FF65F2B47F8
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF65F2B4907
System.GC.HeapHardLimitPercent, xrefs: 00007FF65F2B4444
BGCFLEnableFF, xrefs: 00007FF65F2B47CF
GCHeapHardLimitPercent, xrefs: 00007FF65F2B444B
BGCMemGoal, xrefs: 00007FF65F2B453F
GCGen1MaxBudget, xrefs: 00007FF65F2B43C4
GCHeapHardLimit, xrefs: 00007FF65F2B441D
GCRetainVM, xrefs: 00007FF65F2B3FA6
System.GC.HeapHardLimitPOH, xrefs: 00007FF65F2B4884
GCEnableSpecialRegions, xrefs: 00007FF65F2B44ED
GCLOHThreshold, xrefs: 00007FF65F2B414B
GCLatencyLevel, xrefs: 00007FF65F2B429B
System.GC.NoAffinitize, xrefs: 00007FF65F2B3FF4
GCNumaAware, xrefs: 00007FF65F2B4071
GCGen0MaxBudget, xrefs: 00007FF65F2B439B
System.GC.DynamicAdaptationMode, xrefs: 00007FF65F2B49DE
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF65F2B48AB
gcConservative, xrefs: 00007FF65F2B3F4F
GCDynamicAdaptationMode, xrefs: 00007FF65F2B49E5
BGCFLki, xrefs: 00007FF65F2B460C
GCMaxHeapCount, xrefs: 00007FF65F2B41F9
GCBreakOnOOM, xrefs: 00007FF65F2B3FCC
GCSpinCountUnit, xrefs: 00007FF65F2B49B5
BGCSpin, xrefs: 00007FF65F2B419B
BGCFLEnableTBH, xrefs: 00007FF65F2B47A6
BGCFLGradualD, xrefs: 00007FF65F2B46B0
BGCFLEnableKi, xrefs: 00007FF65F2B472B
GCLogEnabled, xrefs: 00007FF65F2B4021
GCHeapCount, xrefs: 00007FF65F2B41CB
gcConcurrent, xrefs: 00007FF65F2B3F29
BGCFLSweepGoalLOH, xrefs: 00007FF65F2B45BA
System.GC.HighMemoryPercent, xrefs: 00007FF65F2B4344
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF65F2B48D9
GCWriteBarrier, xrefs: 00007FF65F2B498C
BGCSpinCount, xrefs: 00007FF65F2B4172
System.GC.MaxHeapCount, xrefs: 00007FF65F2B41F2
GCCompactRatio, xrefs: 00007FF65F2B42ED
BGCFLEnableSmooth, xrefs: 00007FF65F2B477D
System.GC.HeapHardLimitSOH, xrefs: 00007FF65F2B4821
GCProvModeStress, xrefs: 00007FF65F2B4372
BGCFLTuningEnabled, xrefs: 00007FF65F2B4516
GCHeapHardLimitSOHPercent, xrefs: 00007FF65F2B48B2
System.GC.HeapAffinitizeMask, xrefs: 00007FF65F2B4316
gcServer, xrefs: 00007FF65F2B3F02
BGCFLSweepGoal, xrefs: 00007FF65F2B4591
BGCMLkp, xrefs: 00007FF65F2B46D9
System.GC.HeapHardLimitLOH, xrefs: 00007FF65F2B484F
HeapVerify, xrefs: 00007FF65F2B40F3
System.GC.Server, xrefs: 00007FF65F2B3EFB
System.GC.ConserveMemory, xrefs: 00007FF65F2B495E
System.GC.DTargetTCP, xrefs: 00007FF65F2B4A0C
gcForceCompact, xrefs: 00007FF65F2B3F77
GCLowSkipRatio, xrefs: 00007FF65F2B43ED
GCHighMemPercent, xrefs: 00007FF65F2B434B
BGCMemGoalSlack, xrefs: 00007FF65F2B4568
GCSegmentSize, xrefs: 00007FF65F2B4249
System.GC.RetainVM, xrefs: 00007FF65F2B3F9F
BGCFLff, xrefs: 00007FF65F2B465E
GCRegionRange, xrefs: 00007FF65F2B449B
GCNoAffinitize, xrefs: 00007FF65F2B3FFB
GCHeapAffinitizeMask, xrefs: 00007FF65F2B431D
GCHeapHardLimitLOH, xrefs: 00007FF65F2B4856
GCTotalPhysicalMemory, xrefs: 00007FF65F2B4472
System.GC.LargePages, xrefs: 00007FF65F2B40C6
GCLogFileSize, xrefs: 00007FF65F2B42CD
BGCFLSmoothFactor, xrefs: 00007FF65F2B4690
System.GC.Concurrent, xrefs: 00007FF65F2B3F22
GCLOHCompact, xrefs: 00007FF65F2B411B
BGCMLki, xrefs: 00007FF65F2B4702
System.GC.HeapHardLimit, xrefs: 00007FF65F2B4416
GCHeapHardLimitLOHPercent, xrefs: 00007FF65F2B48E0
GCEnabledInstructionSets, xrefs: 00007FF65F2B4935
GCHeapHardLimitSOH, xrefs: 00007FF65F2B4828
GCConserveMemory, xrefs: 00007FF65F2B4965
GCLatencyMode, xrefs: 00007FF65F2B4272
GCCpuGroup, xrefs: 00007FF65F2B40A0
GCHeapHardLimitPOHPercent, xrefs: 00007FF65F2B490E
GCConfigLogEnabled, xrefs: 00007FF65F2B4049
GCLargePages, xrefs: 00007FF65F2B40CD
BGCFLkd, xrefs: 00007FF65F2B4635
BGCFLkp, xrefs: 00007FF65F2B45E3
BGCFLEnableKd, xrefs: 00007FF65F2B4754
GCRegionSize, xrefs: 00007FF65F2B44CD
GCHeapHardLimitPOH, xrefs: 00007FF65F2B488B

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: strcmp
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$GCBreakOnOOM$GCCompactRatio$GCConfigLogEnabled$GCConserveMemory$GCCpuGroup$GCDTargetTCP$GCDynamicAdaptationMode$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapCount$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLOHCompact$GCLOHThreshold$GCLargePages$GCLatencyLevel$GCLatencyMode$GCLogEnabled$GCLogFileSize$GCLowSkipRatio$GCMaxHeapCount$GCNoAffinitize$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCRetainVM$GCSegmentSize$GCSpinCountUnit$GCTotalPhysicalMemory$GCWriteBarrier$GCgen0size$HeapVerify$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.DTargetTCP$System.GC.DynamicAdaptationMode$System.GC.HeapAffinitizeMask$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LOHThreshold$System.GC.LargePages$System.GC.MaxHeapCount$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server$gcConcurrent$gcConservative$gcForceCompact$gcServer
API String ID: 1004003707-1492036319
Opcode ID: 4191eb02c31c6530e6ec1d622d11567a61af9ffd1ff6ecc5b188b8cc01225dc0
Instruction ID: c0fc5e5332f97e88c23946828e320d672df5bea436a49e1fbf913276f68eac46
Opcode Fuzzy Hash: 4191eb02c31c6530e6ec1d622d11567a61af9ffd1ff6ecc5b188b8cc01225dc0
Instruction Fuzzy Hash: 3D629460D0DB8790EF01DBA5E8504F927A2AF95784F8C4536C68CEB2B7DE7CA159C342

Function 00007FF65F2B2F60 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF65F2B2F9C
GetCurrentProcess.KERNEL32 ref: 00007FF65F2B2FC4
OpenProcessToken.ADVAPI32 ref: 00007FF65F2B2FD7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF65F2B2FFC
GetLastError.KERNEL32 ref: 00007FF65F2B3004
CloseHandle.KERNEL32 ref: 00007FF65F2B3011
GetLargePageMinimum.KERNEL32 ref: 00007FF65F2B3026
VirtualAlloc.KERNEL32 ref: 00007FF65F2B3057
GetCurrentProcess.KERNEL32 ref: 00007FF65F2B3063
VirtualAllocExNuma.KERNEL32 ref: 00007FF65F2B3083

Strings

SeLockMemoryPrivilege, xrefs: 00007FF65F2B2F95

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: 15b15ab6d6ee02b3c5b0b81b0fa05c43a8a43f1a4b1e1b9cf4b9317159724ae4
Instruction ID: 9bc4a2536e14afa67609c462016aea7d332a40dbdfd05f773e9d246e19d46122
Opcode Fuzzy Hash: 15b15ab6d6ee02b3c5b0b81b0fa05c43a8a43f1a4b1e1b9cf4b9317159724ae4
Instruction Fuzzy Hash: E4318572A0CA4286FB609BA1F54437BA7A1EF84B84F184435DE4EA7796DF7DD4848B00

Function 00007FF65F2A6ED0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF65F2A7871), ref: 00007FF65F2A6F88
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF65F2A7871), ref: 00007FF65F2A70DB
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF65F2A7871), ref: 00007FF65F2A71B3
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF65F2A7871), ref: 00007FF65F2A71C9
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF65F2A7871), ref: 00007FF65F2A7245

Strings

[ KeepUnwinding ], xrefs: 00007FF65F2A71E4

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: a194a7c0d0f8bf0d13eda8b02fc6739eea9f927413269e725c7a1e9c4323ee48
Instruction ID: a2dd28ab9202ea637f4ef474f98bebb074d0ed9c4475eb40fdffc31120a37364
Opcode Fuzzy Hash: a194a7c0d0f8bf0d13eda8b02fc6739eea9f927413269e725c7a1e9c4323ee48
Instruction Fuzzy Hash: B6B1CFB2A09B4281EB90CFA0D5802A933E6FB44B48F5C4536CE8DAB398DF7DE455C354

Function 00007FF65F2D31E0 Relevance: 4.8, APIs: 3, Instructions: 256threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF65F2D329C
SwitchToThread.KERNEL32 ref: 00007FF65F2D32A5

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: de3af9872942d2e5463f82b08a78e24417d9ee751223df948923f138561bc3d3
Instruction ID: 24878a6afa12a239dd0759f111d2ee7a9c4f249b22c68cf06cdec25e74075a87
Opcode Fuzzy Hash: de3af9872942d2e5463f82b08a78e24417d9ee751223df948923f138561bc3d3
Instruction Fuzzy Hash: 43B17BB1E49A4386EB508BA8D6442B833A0FF04B94F4D4635DA5DE7396DF3CE9868341

Function 00007FF65F2BD620 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF65F2BD816
LeaveCriticalSection.KERNEL32 ref: 00007FF65F2BD830

Strings

@, xrefs: 00007FF65F2BD83A

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @
API String ID: 3168844106-2766056989
Opcode ID: 5db7b6a377614d9f480f265109a2fe80749a182d1a3adcd727705f5ae378369e
Instruction ID: 5efc018fee047ce3cf09c579e8b32524522ca8f4476630c583959fd42d249e5c
Opcode Fuzzy Hash: 5db7b6a377614d9f480f265109a2fe80749a182d1a3adcd727705f5ae378369e
Instruction Fuzzy Hash: AC913FA1E0CA4382FB51CBA5EA403B523A1AF54788F5C4435DE4DE77AADE3CF4858702

Function 00007FF65F2DE8E0 Relevance: 3.3, APIs: 2, Instructions: 344threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF65F2DEA55
SwitchToThread.KERNEL32 ref: 00007FF65F2DEA85

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: c2dd94c7d96df3f2775cdd799debc1e0e9d9a61e5e2074260edde2e60430f6ac
Instruction ID: b0ca1c3561eb575e38fb7036c4f329a9836c8a13cb8903a56a07a49a8bbc10a9
Opcode Fuzzy Hash: c2dd94c7d96df3f2775cdd799debc1e0e9d9a61e5e2074260edde2e60430f6ac
Instruction Fuzzy Hash: 5DE18172A09E9282EB60CF55E5403A9B360FF44B94F594232DA9DE7799DF7CE442CB00

Function 00007FF65F2B2080 Relevance: 3.2, APIs: 2, Instructions: 175COMMON

Download Yara Rule

APIs

GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF65F2A828B,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2B211F
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF65F2A828B,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2B217C

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: EnabledFeaturesState
String ID:
API String ID: 1557480591-0
Opcode ID: 72210cc46d501d66917d4aa4741235ebaad592b546a2f8b3c708735d4c7245cd
Instruction ID: ffb96169523f3a504e59e78f28306bd975f46ffcf9d4e449a9da2b83a2b4e4e6
Opcode Fuzzy Hash: 72210cc46d501d66917d4aa4741235ebaad592b546a2f8b3c708735d4c7245cd
Instruction Fuzzy Hash: 8651CEB2F1832206FF69449DD669375038B5BE5360F4E8938DE4EE76C3CD7EA8424A04

Function 00007FF65F2CC7D0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF65F2CC896
LeaveCriticalSection.KERNEL32 ref: 00007FF65F2CC8B0

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d59cc5cb1b18531cba8ca60925d5e3cb69ecf232ff52c5df66362fa8286c3256
Instruction ID: 9247ba2c03e0d66c37f92e95af27abd4fdff8cfdc0a527f57bae9bd713b470ea
Opcode Fuzzy Hash: d59cc5cb1b18531cba8ca60925d5e3cb69ecf232ff52c5df66362fa8286c3256
Instruction Fuzzy Hash: A4417C72A18A9781EB10DFA6DA5017A63A0FF48BC4B1C4536DF4DA7B9ADF3CE0118740

Function 00007FF65F2D4B10 Relevance: 1.8, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

, xrefs: 00007FF65F2D505B

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d80cb2096afa2d96802b29f732793f8d2c2ea0a515708a2f5b61d075e09ca355
Instruction ID: 86242714bfec912acd77084f66f0a6e41139bc757143837051a94da6ad45e5f2
Opcode Fuzzy Hash: d80cb2096afa2d96802b29f732793f8d2c2ea0a515708a2f5b61d075e09ca355
Instruction Fuzzy Hash: 8442AAB2A19A8686EB11CF55EA0027837A0FF447A4F094636CA6DE77E5CF7CE456C301

Function 00007FF65F2C02A0 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF65F2C02EB

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: d973c782404e594d9bcbf2e5c6d56061f7dad822c0a4488c5f43b24ac340032d
Instruction ID: cb622893dd8f8eb5ec07a367ef3f4f44c3476da6206171e351532e654be97d09
Opcode Fuzzy Hash: d973c782404e594d9bcbf2e5c6d56061f7dad822c0a4488c5f43b24ac340032d
Instruction Fuzzy Hash: EA12CCB2A08B8692EB14CB56E6407B973A5FB84B94F584231CE5EE3794DF3CE045CB41

Function 00007FF65F2ABF90 Relevance: 1.6, Strings: 1, Instructions: 362COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF65F2AC2B3

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ed46fb5e053d378f1610507a2dc2373cd927df4da4c90f69d846193864f28d75
Instruction ID: 20885a56f025561e42893e02e9d38a4f3eae7fdeb050adf0c94a06443da4aa25
Opcode Fuzzy Hash: ed46fb5e053d378f1610507a2dc2373cd927df4da4c90f69d846193864f28d75
Instruction Fuzzy Hash: 6AD1DDF3B14B4987E718AF69E60466933A2EB44BD8F185235CE9E57B98CF78D810C740

Function 00007FF65F2AEB00 Relevance: 1.6, APIs: 1, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF65F2A826E,?,?,?,?,?,?,00007FF65F2A2000), ref: 00007FF65F2AEBCC

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 01526b02e241dee81f399a2eac65e121072c1da9abb2975d62793974b100dfe8
Instruction ID: fc5bff2bde29cdd414a3faf8132b26b86e7e8e593459a29f0df6ccc3c17f1a26
Opcode Fuzzy Hash: 01526b02e241dee81f399a2eac65e121072c1da9abb2975d62793974b100dfe8
Instruction Fuzzy Hash: 0C211B71E0EB4386EB40DB65E84026A73A0FB88344F584539E64DE3B66DFBCE4848B41

Function 00007FF65F2D58C0 Relevance: 1.0, Instructions: 950COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46563421866cb1b5f469f90219f00d70860dff413f8aa2cbdd885a1ae4a15a1
Instruction ID: 1ac4701b067d21d72ef758e179f26dec2b5d1e54acfb1b34ab44bfa3a07c54ce
Opcode Fuzzy Hash: c46563421866cb1b5f469f90219f00d70860dff413f8aa2cbdd885a1ae4a15a1
Instruction Fuzzy Hash: 6692D0A1B18B4785EB11CBA5DA516B467A1BF48BC4F4C8236DA4EF7362DF3CE0468301

Function 00007FF65F2D67E0 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801744bdd96377547b888a3c70e772e67b1585d8fb76d1f3f959e3ca14fd2e86
Instruction ID: 67a6b8e801f9a4b391aad1249e181a2a0150893e1ffd01670e36712554473677
Opcode Fuzzy Hash: 801744bdd96377547b888a3c70e772e67b1585d8fb76d1f3f959e3ca14fd2e86
Instruction Fuzzy Hash: E7527172B09B4686EB10CFA5E5401AD7BA1FB44798B184536EE4EE7B98CF3CE446C704

Function 00007FF65F2D71B0 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781d2a1a5c9ba1d80fa3332f439c67dbd3f5da6a5da9899e467eda87960517b7
Instruction ID: ab1c829369a3b3f61462b4ec33d8480c949704dc42e5bc309842580c6e2c171a
Opcode Fuzzy Hash: 781d2a1a5c9ba1d80fa3332f439c67dbd3f5da6a5da9899e467eda87960517b7
Instruction Fuzzy Hash: 393290B2F09B5686EB10CBA5D6406BC27B5AF04798B584935CE1DF7B88DE3CE456C380

Function 00007FF65F2C6C90 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12364d0ff0cea06089e9274694b767b8b30ef639dd9b265c612d6c852c853e6b
Instruction ID: 0464bca642ea27aa7dc8414893541a0d1813c5f9158cb88016bf6356e39edd82
Opcode Fuzzy Hash: 12364d0ff0cea06089e9274694b767b8b30ef639dd9b265c612d6c852c853e6b
Instruction Fuzzy Hash: 69127EF2A16B9691EF658B59C2443686BA1FF18BA4F189635CE2CA33D4DF7DD490C300

Function 00007FF65F357F40 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313dea30c798e73606019446f4cb135ba51061c0bfdcea6891a82da26de4cdd6
Instruction ID: a9ef0508f3ba97cd8e7d92fd625a60c59020cbef4739b6af8a725c1ddc4a2e27
Opcode Fuzzy Hash: 313dea30c798e73606019446f4cb135ba51061c0bfdcea6891a82da26de4cdd6
Instruction Fuzzy Hash: FAF13862F1999242FB284B18D8417BA6352EFD1344F5CC234DE5EAFAD8EE3CE5458780

Function 00007FF65F2C1D60 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ca48302f7e549fd0b9dcb0b29a96f96b9d26f61ae64e1577846578a65f7f54
Instruction ID: 8ab05ec725a6c722ac9c06ad6f8fe67447fc507050ffe54967e1f4b7a792c669
Opcode Fuzzy Hash: 00ca48302f7e549fd0b9dcb0b29a96f96b9d26f61ae64e1577846578a65f7f54
Instruction Fuzzy Hash: CE02BFB2A08A8696EB05CF99D6406B877A0FB44BA4F484336DA7DA77D5CF3CE445C700

Function 00007FF65F2C17B4 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-0
Opcode ID: dbabca0daaad52e6d2fee9b053951e65599bec3c22e1c459a219101abfb20a77
Instruction ID: aae55be8710df788b26c0939303dec5b4a894600c26f759828f353fc9730c27c
Opcode Fuzzy Hash: dbabca0daaad52e6d2fee9b053951e65599bec3c22e1c459a219101abfb20a77
Instruction Fuzzy Hash: B702AEB1E1AB4785EB56CB65D65137427A0AF48B54F2C4236DA4EB33A1EF3CE491C301

Function 00007FF65F2AB6F0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21cb066ba30a2d58ebcf8ae559d9ba3061f44fe4dc0b64825ad821ff6f3f83a3
Instruction ID: a3737d34a34dccac71128422510ef11f55fd213ba5478e133dc3e16978b710be
Opcode Fuzzy Hash: 21cb066ba30a2d58ebcf8ae559d9ba3061f44fe4dc0b64825ad821ff6f3f83a3
Instruction Fuzzy Hash: E0D1AAB3B14B8983DB598F29E144AA837A9F758BC8F484035DE4E8BB58DF38D644C750

Function 00007FF65F32DD30 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da7e54ed24954a500e0de7022938a4671c5c3d7a4c5f28315c5e883fd872f53
Instruction ID: dfd95ecc0d2c9ea704a869d090e8c070f67507d44bb3c5c7717f19fd18e53ba5
Opcode Fuzzy Hash: 7da7e54ed24954a500e0de7022938a4671c5c3d7a4c5f28315c5e883fd872f53
Instruction Fuzzy Hash: 56615F50E2940656F918BF66AC550F4A3711FAAB80F4C2832D95EFF7A3AE5CE1594380

Function 00007FF65F2B81F0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6dc304a19f2a48ee2c861db27342cb39ee3eea17acda9183df1afc939c6c05
Instruction ID: aaa6c9e560afb2f5601e621a9f04642f3e74bc22a6844d5076c57ceb16c62c98
Opcode Fuzzy Hash: 7f6dc304a19f2a48ee2c861db27342cb39ee3eea17acda9183df1afc939c6c05
Instruction Fuzzy Hash: 67D15CB2A0AA8786E760CB54E9442BA33A0FB44748F4D4935DE4EE7766DF3CE4568301

Function 00007FF65F2CBC80 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6254c0ef687fac40c48f3d506a17342e23e87eff8218f83829c6cce0c6783e
Instruction ID: d0f9ce619d9634f2b4635c30332ca772f57e5906b522453b776add37bfa9fdd9
Opcode Fuzzy Hash: 4d6254c0ef687fac40c48f3d506a17342e23e87eff8218f83829c6cce0c6783e
Instruction Fuzzy Hash: E3C1ABB2A19A8791EB01CB95E95023877A4FB44BA0F0D4635DA6DE77E6CF3CE494C301

Function 00007FF65F2D5490 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28436a9c3417000466a2d9979135604bb1afaa64b481e814e6aa6ec24cae149b
Instruction ID: 2d4664c2f12b43b93a9f76f62a65156389a588fdf707df1dbf432d099614227d
Opcode Fuzzy Hash: 28436a9c3417000466a2d9979135604bb1afaa64b481e814e6aa6ec24cae149b
Instruction Fuzzy Hash: 5DC18CB2A19A8781EB01CB55E90117877A5FF44BA4B0C423ADA6DE77E5CF7CE096C301

Function 00007FF65F2A82D0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c9ebb636796ca0e2a1abc168f63624881ec9cfa17a1a52ac6cfbaa34e87d82
Instruction ID: e921e043206a2bf1b11ef1c3c97ca406208650cde3671e177b59555ec9da08cb
Opcode Fuzzy Hash: 86c9ebb636796ca0e2a1abc168f63624881ec9cfa17a1a52ac6cfbaa34e87d82
Instruction Fuzzy Hash: 7E91FCF3A10B5587EB18CF29D84126933A1F754BA8F189239CEAD53B98DF78D811CB40

Function 00007FF65F3DD7E0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94133470a1cdfe2213458b368141420a258a13cfa6e3db9c0818582347a24da2
Instruction ID: 48b7bc66df2622d67077cd659c5fbaa1791c423e1421a54857fe9ceb46b4c74d
Opcode Fuzzy Hash: 94133470a1cdfe2213458b368141420a258a13cfa6e3db9c0818582347a24da2
Instruction Fuzzy Hash: DE4183A1A194429AF604AF63ED415F967646FA4FC0F4C8032ED0DEB76BEE6CE5458380

Function 00007FF65F2B9A90 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cfc7e4d115ce1370a28ac6abb2cf91c2911c6ad5a29bc3d3fae3187189239e
Instruction ID: 1bddf61683e0845500f6afe44497df402bb8a25f313ab6da1ed8fd25127b34c6
Opcode Fuzzy Hash: c4cfc7e4d115ce1370a28ac6abb2cf91c2911c6ad5a29bc3d3fae3187189239e
Instruction Fuzzy Hash: A741F7A1F19B0F41EA06C7B79640624A3939F6A3D0E2CCB31DD1DB67D6EF6C70904200

Function 00007FF65F2CC0A0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee72cb688372a8b7ca6c53026427fe1cb6e98e11cf675aa8f3c1fed9b58c5e49
Instruction ID: 3be1c782d548a1ed2dbf39ab21108c2ecb1c16a95b3d54f5d4444744255c81f6
Opcode Fuzzy Hash: ee72cb688372a8b7ca6c53026427fe1cb6e98e11cf675aa8f3c1fed9b58c5e49
Instruction Fuzzy Hash: AD412971F59B8A41EA1697BB56015795351AF89BC4F1CCB32DA0EB7791EF7CF0818200

Function 00007FF65F363D20 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7533faf894bf0ca9caf5f1480e5f2de4d9b878ab499b8342825ab4e25c589ece
Instruction ID: ae80191761ff2ffdd3952ca13ae4c555d2ad2190d3c699aa4d83ca0e417359b4
Opcode Fuzzy Hash: 7533faf894bf0ca9caf5f1480e5f2de4d9b878ab499b8342825ab4e25c589ece
Instruction Fuzzy Hash: D531F923F8954582FB589F56D4910BC6361EB46BC4B4C9031EE0DAB395DF2CEC928390

Function 00007FF65F2D29B0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f6a76dfd64ef7b78e5c6641dc319f4b652810589be1d7a6d8d44123e559c2a
Instruction ID: 7fd1524fc6d1296ced89e91ea19c1068ad1e990a0ac9d8b766331f156524c2bc
Opcode Fuzzy Hash: 58f6a76dfd64ef7b78e5c6641dc319f4b652810589be1d7a6d8d44123e559c2a
Instruction Fuzzy Hash: 1721CC72B1864242FBB88769A3966BE1351EF89780F4C6031EF0C97E96DD2DD5924B00

Function 00007FF65F2A39D0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID:
API String ID: 3706814929-0
Opcode ID: b4f4eecb476bf04b12e31564723069907bbc9b466724c713cfc222d08a9c6718
Instruction ID: ef290471a883719eb4b7246b065b129ff98835d41794251e80e0c0b5dce33ce3
Opcode Fuzzy Hash: b4f4eecb476bf04b12e31564723069907bbc9b466724c713cfc222d08a9c6718
Instruction Fuzzy Hash: 55212622B2854642FB20CB5AE454BBB6351EB84780F485030FF8FE6B94ED7DD408C740

Function 00007FF65F2A1C50 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e9d75f7367e1f09548789f8d2b40ec955cb63071d47f2e06fc1c59d2d11a99
Instruction ID: c3f7e955553c65757e4ac35f9b02d3d5c06607e15e2b034702195b96bf704a9b
Opcode Fuzzy Hash: e8e9d75f7367e1f09548789f8d2b40ec955cb63071d47f2e06fc1c59d2d11a99
Instruction Fuzzy Hash: D7F0A050E6900296F914FF66AC110F5A3B11FA6780F5C2832D80EFF2A3BE4CE1484388

Function 00007FF65F2A3000 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 144librarythreadloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF65F2ACF00
GetProcAddress.KERNEL32 ref: 00007FF65F2ACF13
GetCurrentProcess.KERNEL32 ref: 00007FF65F2ACF25
VerSetConditionMask.KERNEL32 ref: 00007FF65F2ACF8B
VerSetConditionMask.KERNEL32 ref: 00007FF65F2ACF9B
VerSetConditionMask.KERNEL32 ref: 00007FF65F2ACFAB
VerifyVersionInfoW.KERNEL32 ref: 00007FF65F2ACFD3
GetProcAddress.KERNEL32 ref: 00007FF65F2ACFE7
GetLastError.KERNEL32 ref: 00007FF65F2AD03E
SuspendThread.KERNEL32 ref: 00007FF65F2AD058
GetThreadContext.KERNEL32 ref: 00007FF65F2AD079
ResumeThread.KERNEL32 ref: 00007FF65F2AD0B3

Strings

QueueUserAPC2, xrefs: 00007FF65F2ACFDD
kernel32, xrefs: 00007FF65F2ACEF3
IsWow64Process2, xrefs: 00007FF65F2ACF09

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ConditionMaskThread$AddressProc$ContextCurrentErrorInfoLastLibraryLoadProcessResumeSuspendVerifyVersion
String ID: IsWow64Process2$QueueUserAPC2$kernel32
API String ID: 2652322181-269241671
Opcode ID: 2ed5142675b828450414f6af03e9e150d3f22da0891d8269898bcd82b2a367be
Instruction ID: cd99b9493355036feb7af53759c1dc183b5d073c9bb71889d1107a2c5e993eec
Opcode Fuzzy Hash: 2ed5142675b828450414f6af03e9e150d3f22da0891d8269898bcd82b2a367be
Instruction Fuzzy Hash: 6551D071A08A4281EB20DB61E9402BA63A1FF84B90F484235DE9DE77D5EF7DE446C700

Function 00007FF65F2A3007 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 142librarythreadloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF65F2ACF00
GetProcAddress.KERNEL32 ref: 00007FF65F2ACF13
GetCurrentProcess.KERNEL32 ref: 00007FF65F2ACF25
VerSetConditionMask.KERNEL32 ref: 00007FF65F2ACF8B
VerSetConditionMask.KERNEL32 ref: 00007FF65F2ACF9B
VerSetConditionMask.KERNEL32 ref: 00007FF65F2ACFAB
VerifyVersionInfoW.KERNEL32 ref: 00007FF65F2ACFD3
GetProcAddress.KERNEL32 ref: 00007FF65F2ACFE7
GetLastError.KERNEL32 ref: 00007FF65F2AD03E
SuspendThread.KERNEL32 ref: 00007FF65F2AD058
GetThreadContext.KERNEL32 ref: 00007FF65F2AD079
ResumeThread.KERNEL32 ref: 00007FF65F2AD0B3

Strings

QueueUserAPC2, xrefs: 00007FF65F2ACFDD
kernel32, xrefs: 00007FF65F2ACEF3
IsWow64Process2, xrefs: 00007FF65F2ACF09

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ConditionMaskThread$AddressProc$ContextCurrentErrorInfoLastLibraryLoadProcessResumeSuspendVerifyVersion
String ID: IsWow64Process2$QueueUserAPC2$kernel32
API String ID: 2652322181-269241671
Opcode ID: 4825748d57e2d133e0b0926e79e8171601229c5e1e52b9d54749e5c96503095b
Instruction ID: 3a71a5e64bf17c10f80a15e424d22ef51f550796a1d1324b4aeddc1a01128a44
Opcode Fuzzy Hash: 4825748d57e2d133e0b0926e79e8171601229c5e1e52b9d54749e5c96503095b
Instruction Fuzzy Hash: B051BE71A08A4281EB60DB61E9542BA73A1FF88B80F484135DE8EE7795EF7DE446C740

Function 00007FF65F2ADBD0 Relevance: 24.1, APIs: 8, Strings: 8, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADC0E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADC36
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADC76
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADC96
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADCBA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADCDE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2ADD02

Strings

GCHeapHardLimitPercent, xrefs: 00007FF65F2ADC2C
GCHeapHardLimitLOHPercent, xrefs: 00007FF65F2ADCD4
GCHeapHardLimitSOH, xrefs: 00007FF65F2ADC4C
GCHeapHardLimitLOH, xrefs: 00007FF65F2ADC6C
GCHeapHardLimit, xrefs: 00007FF65F2ADC07
GCHeapHardLimitPOHPercent, xrefs: 00007FF65F2ADCF8
GCHeapHardLimitSOHPercent, xrefs: 00007FF65F2ADCB0
GCHeapHardLimitPOH, xrefs: 00007FF65F2ADC8C

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: strcmp
String ID: GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent
API String ID: 1004003707-945519297
Opcode ID: a2420435b7c8d9abb28f4f8f1ce3c06c939d7a2a25c3777b265420f1345e2620
Instruction ID: 5da6424c7f31c20fb7d05219927ef44eaceb6714ede0108d037c6744fc1797c8
Opcode Fuzzy Hash: a2420435b7c8d9abb28f4f8f1ce3c06c939d7a2a25c3777b265420f1345e2620
Instruction Fuzzy Hash: 33412DA0E09A5340FB549756964017513A6AF457F4F8C0371DABCFBAEAEFACE8568300

Function 00007FF65F2ACBA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF65F2A3177), ref: 00007FF65F2ACBC3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF65F2A3177), ref: 00007FF65F2ACBD8
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF65F2A3177), ref: 00007FF65F2ACBE5
InitializeContext.KERNEL32(?,?,?,?,?,00007FF65F2A3177), ref: 00007FF65F2ACC23
GetLastError.KERNEL32(?,?,?,?,?,00007FF65F2A3177), ref: 00007FF65F2ACC31
InitializeContext.KERNEL32(?,?,?,?,?,00007FF65F2A3177), ref: 00007FF65F2ACC85

Strings

InitializeContext2, xrefs: 00007FF65F2ACBCE
kernel32.dll, xrefs: 00007FF65F2ACBBC

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: 82a1c9d27e223d2f7ed7079b8632d6de5b9a1da43eacd26cd441cc06c39dd239
Instruction ID: 32174eba507d1f8f84784e94a1992d81bf765a4a65b6097f2787977a3af2e455
Opcode Fuzzy Hash: 82a1c9d27e223d2f7ed7079b8632d6de5b9a1da43eacd26cd441cc06c39dd239
Instruction Fuzzy Hash: BB311A62A0DB5781FF10EB95A54027AA391BF88B90F4C0435DE8DE27A5DFBCE486C710

Function 00007FF65F2A33B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65F2ACE60: GetCurrentThreadId.KERNEL32 ref: 00007FF65F2ACE64

GetCurrentProcess.KERNEL32 ref: 00007FF65F2A33F6
GetCurrentThread.KERNEL32 ref: 00007FF65F2A33FE
DuplicateHandle.KERNEL32 ref: 00007FF65F2A3422

Part of subcall function 00007FF65F2AE660: VirtualQuery.KERNEL32 ref: 00007FF65F2AE692

RaiseFailFastException.KERNEL32 ref: 00007FF65F2A3450

Strings

, xrefs: 00007FF65F2A3464

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: f93380af70f62f54b1a1923f466ad22b5765e184aabf6e9d0340985e501fe6c0
Instruction ID: a895eeda8746fba6a7ff87cac4ef51dede2b37effcdf849fd00fb361b8ab459a
Opcode Fuzzy Hash: f93380af70f62f54b1a1923f466ad22b5765e184aabf6e9d0340985e501fe6c0
Instruction Fuzzy Hash: 1B117CB2A08B818AE760EF65B44119A7360FB407B4F180335E6BD9BAD6CF78D5428740

Function 00007FF65F2D7C50 Relevance: 7.6, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF65F2D7D05
LeaveCriticalSection.KERNEL32 ref: 00007FF65F2D7D5E
EnterCriticalSection.KERNEL32 ref: 00007FF65F2D7E21
LeaveCriticalSection.KERNEL32 ref: 00007FF65F2D7E42
EnterCriticalSection.KERNEL32 ref: 00007FF65F2D7E85
LeaveCriticalSection.KERNEL32 ref: 00007FF65F2D7EA6

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2dee9989788879160bfabb33313de8680af437fb421886637dde01d970805108
Instruction ID: c955be289dde1c23f09916ec17badf593d0e258c45e4ddba939118eb4a24458b
Opcode Fuzzy Hash: 2dee9989788879160bfabb33313de8680af437fb421886637dde01d970805108
Instruction Fuzzy Hash: ED617961A09B4784EB50DB55E9802B973A4FF88784F4C0936DE8CE77AADF3CE4468741

Function 00007FF65F2D2F80 Relevance: 7.6, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF65F2D3025
LeaveCriticalSection.KERNEL32 ref: 00007FF65F2D307D

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 20abf027c1ecf4cec0434be30c3f4d2e3ceadcdb0d0e9a6b2ffb4e85abde6f79
Instruction ID: 99c71fc2e99a5b03fbaf1dc462b7e435a31d58d81dcb0699bf7bcf3f139e9cc8
Opcode Fuzzy Hash: 20abf027c1ecf4cec0434be30c3f4d2e3ceadcdb0d0e9a6b2ffb4e85abde6f79
Instruction Fuzzy Hash: 25513861A08B8781EB60DB55E9403B973A4FF88784F4C0536DA8DE77AADF3CE4468701

Function 00007FF65F2A3EB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF65F2A3F50
RaiseFailFastException.KERNEL32 ref: 00007FF65F2A4059
RaiseFailFastException.KERNEL32 ref: 00007FF65F2A4096

Strings

Process is terminating due to StackOverflowException., xrefs: 00007FF65F2A3F3A

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: edcb76423634533c14701209537ab2eaed2715ea9f1ac3b1dd4543dc0ac9788a
Instruction ID: f086cb7e903f48fe12a6b75462c4046c2f67879ca2bfa91ddff65d5bdc4f578d
Opcode Fuzzy Hash: edcb76423634533c14701209537ab2eaed2715ea9f1ac3b1dd4543dc0ac9788a
Instruction Fuzzy Hash: EC51C561B1864281FF548B65D6803B963E0EF48B94F0C4432DB9EE77A1DFBDE8A58300

Function 00007FF65F2E1970 Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?,?,?,00007FF65F2BC7EB), ref: 00007FF65F2E19EB
SwitchToThread.KERNEL32(?,?,?,00007FF65F2BC7EB), ref: 00007FF65F2E1A92
SwitchToThread.KERNEL32(?,?,?,00007FF65F2BC7EB), ref: 00007FF65F2E1AA8

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 95544bbce4b90e12acf5c392e48b6c2ca22bac221c7c535adcad6349c9bd3327
Instruction ID: 184facda3bbce8931e8877c766c1c30136f2460e3366e0b64b2d9403a90deb38
Opcode Fuzzy Hash: 95544bbce4b90e12acf5c392e48b6c2ca22bac221c7c535adcad6349c9bd3327
Instruction Fuzzy Hash: 984185B2B0964785EB648EB6D24067D73A0EB05B98F6C813AC74EDE789DE3CE440C700

Function 00007FF65F2ACD10 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65F2A3541), ref: 00007FF65F2ACD44
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65F2A3541), ref: 00007FF65F2ACD4E
CoWaitForMultipleHandles.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65F2A3541), ref: 00007FF65F2ACD6D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65F2A3541), ref: 00007FF65F2ACD81

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 71cbba1b383cf0b7fb516053fcd2ddd0c29d4ad2df29a1dc53a75a309a826a29
Instruction ID: f24e571fd34e65a469df40c50d8e9d32dfdc0fe2900363b3cadc9db78275cc8b
Opcode Fuzzy Hash: 71cbba1b383cf0b7fb516053fcd2ddd0c29d4ad2df29a1dc53a75a309a826a29
Instruction Fuzzy Hash: 5711C276B0CA55C2D7289B9AB51012AB7A1FB84B80F1C0139FADDD7B99CF7CE4408B40

Function 00007FF65F30BA10 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF65F30BA3C
GetCurrentThreadId.KERNEL32 ref: 00007FF65F30BA4A
GetCurrentProcessId.KERNEL32 ref: 00007FF65F30BA56
QueryPerformanceCounter.KERNEL32 ref: 00007FF65F30BA66

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 78dc8e12354e733f786b704134a88d0c69524484bd1249ff473f58f1b1045164
Instruction ID: b8cf75a7c3e86874758eca647d68b2a348af3b6dfe424b4eaeeb80497839566a
Opcode Fuzzy Hash: 78dc8e12354e733f786b704134a88d0c69524484bd1249ff473f58f1b1045164
Instruction Fuzzy Hash: F9113C22B14F068AEB00DF60EC542B933A4FB59758F480E31EA6D967A5EF7CD5988340

Function 00007FF65F30CF30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F30C243), ref: 00007FF65F30CF80
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65F30C243), ref: 00007FF65F30CFC1

Strings

csm, xrefs: 00007FF65F30CFAE

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2158b8275b8e927ea860eb8b48a04596ff7d9b9df4afa64fc7c7d762c6f39301
Instruction ID: c919d33e1d5d742f689e5cbc1608fee284cbb0da2d066c4074f85aea4157329f
Opcode Fuzzy Hash: 2158b8275b8e927ea860eb8b48a04596ff7d9b9df4afa64fc7c7d762c6f39301
Instruction Fuzzy Hash: C9112832A18B8182EB218B15E44026AB7E5FB88B94F584231EECD5BB69DF7CD551CB40

Function 00007FF65F2AE4E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,HeapVerify,00007FF65F2ADD43,?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2AE51B
strtoull.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,HeapVerify,00007FF65F2ADD43,?,?,?,00007FF65F2B4107,?,?,?,?,00007FF65F2AD115), ref: 00007FF65F2AE558

Strings

HeapVerify, xrefs: 00007FF65F2AE4EF

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: _stricmpstrtoull
String ID: HeapVerify
API String ID: 4031153986-2674988305
Opcode ID: 7c2d8afe691a5ee2b53f1849f6005c7252510a015ecc9786c3c7096a8c5378b9
Instruction ID: 480356edee1137f8dd2602aec1c8f9d876f24042ddb99d35633e1fccaf03554e
Opcode Fuzzy Hash: 7c2d8afe691a5ee2b53f1849f6005c7252510a015ecc9786c3c7096a8c5378b9
Instruction Fuzzy Hash: 5001D475A09A428AE7109F12F9900B9B3E0FB44790F5C9035DA9DA3B09DF7CE483C740

Function 00007FF65F2C5A70 Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000080,00007FF65F2C5BEF,?,?,?,00007FF65F2D33BB), ref: 00007FF65F2C5ABD
LeaveCriticalSection.KERNEL32(?,?,00000080,00007FF65F2C5BEF,?,?,?,00007FF65F2D33BB), ref: 00007FF65F2C5B12
EnterCriticalSection.KERNEL32(?,?,00000080,00007FF65F2C5BEF,?,?,?,00007FF65F2D33BB), ref: 00007FF65F2C5B2F
LeaveCriticalSection.KERNEL32(?,?,00000080,00007FF65F2C5BEF,?,?,?,00007FF65F2D33BB), ref: 00007FF65F2C5B4C

Memory Dump Source

Source File: 00000000.00000002.1894119609.00007FF65F2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65F2A0000, based on PE: true

Associated: 00000000.00000002.1894090588.00007FF65F2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894325462.00007FF65F3EB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894422722.00007FF65F438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894595822.00007FF65F4ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894735412.00007FF65F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65f2a0000_RFQ 10046335 PO 4502042346 PR 11148099 411128.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 9c10fe2d41da5fcf24ebd0dc57c9b975ec7e9fa6664dec3526ce990308116dda
Instruction ID: a21d3ac6775afe2ebdad8dc5dc93291d2136ed8aa8ba202ab87857fac8a104b0
Opcode Fuzzy Hash: 9c10fe2d41da5fcf24ebd0dc57c9b975ec7e9fa6664dec3526ce990308116dda
Instruction Fuzzy Hash: 3221B271A08A4792EB04CF51EA512B923A4EF157E4F8C0235DE6CA77DACF2CE0568701

Analysis Process: jsc.exePID: 7752, Parent PID: 7576COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	4

Executed Functions

Function 054396C8 Relevance: 1.1, Instructions: 1063COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9371356085fb1c6830d542efa933368b7b393df141400b5dd912edd8eb86f76
Instruction ID: 444ccf614b74a4fd882f6aebd1822f205469c598a32590a44e5367300b92c2f1
Opcode Fuzzy Hash: b9371356085fb1c6830d542efa933368b7b393df141400b5dd912edd8eb86f76
Instruction Fuzzy Hash: 48927D75A002059FDB14DF65C895BAEBBB2FF88310F148969E50A9B7A1DF70EC41CB90

Function 05437660 Relevance: .7, Instructions: 749
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def7711e8c91359d56ec59581aaaf8c7a3212a9d141bfbf2711c087e7df6f25d
Instruction ID: 3c7e5fd752396f49c1bbf3938dfcdaa7ceff362e277377094ff3865ef120d155
Opcode Fuzzy Hash: def7711e8c91359d56ec59581aaaf8c7a3212a9d141bfbf2711c087e7df6f25d
Instruction Fuzzy Hash: 5962CE74A002148FDB54DF64D899BAEBBB6FF88301F1085A9E54A9B3A5DF309D81CF50

Function 0543B170 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f8f253015c3cc146a47d287e5f90ad4eb051dda1b6ae4426761ed19a98360c
Instruction ID: 4fe734c787ce6d89f97b79b659073ea0ba025e87b6f4393daf25f160f7a1338b
Opcode Fuzzy Hash: f7f8f253015c3cc146a47d287e5f90ad4eb051dda1b6ae4426761ed19a98360c
Instruction Fuzzy Hash: 3BD13A34B002059FDB18DF69D585AAEBBF2FF88310B548569E90ADB365DB30ED42CB50

Function 00B3AE30 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B3B086

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 108baf7beb2d731c04b5677abdfed8e2024c21d1b225ca6d4e12c825e6d0b93b
Instruction ID: ba3517d9913dcb991b3c3ae504f6b1069efc9ec99f0255d5246490facfee344e
Opcode Fuzzy Hash: 108baf7beb2d731c04b5677abdfed8e2024c21d1b225ca6d4e12c825e6d0b93b
Instruction Fuzzy Hash: 318168B0A00B058FDB24DF69D04179ABBF1FF88304F20896ED48AD7A51D775E849CB91

Function 00B35935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B359F1

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1bb84c1a615c9b2fbefc5a2242539f3b52819962ff5cedce97d5554a93a21b76
Instruction ID: d0be10cd2cb4d5679e16ae6a02c64f6a6af9aad2ce7ebe1d2d462017d9763344
Opcode Fuzzy Hash: 1bb84c1a615c9b2fbefc5a2242539f3b52819962ff5cedce97d5554a93a21b76
Instruction Fuzzy Hash: C641D1B0D00719CEDB24CFAAC984B9DBBF6FF49304F2481AAD408AB251DB756945CF90

Function 00B34248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B359F1

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b5aab47827c91ad99612484109bfb81784e3731d3a0192615f1ed7284f54206b
Instruction ID: cbda5a3d9d892d6bd99cee9e56b38486a8f1fdc17f171d022ca2def31a3a5d17
Opcode Fuzzy Hash: b5aab47827c91ad99612484109bfb81784e3731d3a0192615f1ed7284f54206b
Instruction Fuzzy Hash: 3641C1B0D00619CBDB24CFAAC984B9EBBF6FF48304F60816AD408AB251DB756945CF90

Function 00B3C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B3D2C6,?,?,?,?,?), ref: 00B3D387

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 97fbadc124cc3daf620667a4969950a8b1ca1b3348fab8f25e5fbe11ceea97df
Instruction ID: 7e3dc105d4b1f4f827ae7927ecfcfeea845d32605f9e1210341e181efaca4122
Opcode Fuzzy Hash: 97fbadc124cc3daf620667a4969950a8b1ca1b3348fab8f25e5fbe11ceea97df
Instruction Fuzzy Hash: A021E6B5900348DFDB10CF9AD984AEEBBF5EB48310F24845AE914A7310D378A954CFA5

Function 00B3D2F9 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B3D2C6,?,?,?,?,?), ref: 00B3D387

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 096e5dff38a586e2ee750b463ee3a4949674678b21a45ed06a7eb81b798f811c
Instruction ID: c64aa4cd2b31c4b17c562a79d8cec31db1723ac472d06cf9671dd633a037113f
Opcode Fuzzy Hash: 096e5dff38a586e2ee750b463ee3a4949674678b21a45ed06a7eb81b798f811c
Instruction Fuzzy Hash: 7E21E4B5900249DFDB10CFA9E580ADEBBF5EB48314F24805AE918E3350C378A954CF65

Function 00B3A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B3B101,00000800,00000000,00000000), ref: 00B3B312

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 085ed60f7adb7c3661d4225dd3904170c4d853ca034137f2dad9c9b243749b11
Instruction ID: 78d6e540123c3401819c3774a5733c601ced310448026595c25503fcb056565a
Opcode Fuzzy Hash: 085ed60f7adb7c3661d4225dd3904170c4d853ca034137f2dad9c9b243749b11
Instruction Fuzzy Hash: F41117B6D003499FDB10CF9AC444ADEFBF4EB48314F20845AD515A7200C375A544CFA5

Function 00B3B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B3B101,00000800,00000000,00000000), ref: 00B3B312

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 30d219c04427347180b61fc5780f4d173dc501ae2296c36d314638de88599670
Instruction ID: 93b4c463a129f5b7735e669f66ff46773666dacd5e33e38e6f9707843f9c0d76
Opcode Fuzzy Hash: 30d219c04427347180b61fc5780f4d173dc501ae2296c36d314638de88599670
Instruction Fuzzy Hash: A611D3B69002498FDB10CF9AD444ADEFBF4EB98310F14845AD569A7200C379A545CFA5

Function 00B3B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B3B086

Memory Dump Source

Source File: 00000004.00000002.1995960854.0000000000B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b30000_jsc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7ba923b4aae9a320b3de7c7cc2e3cf7317f9ab3997d3f920a4b628c14e67f703
Instruction ID: b5d37879d2ce0aac733e27a6a28773f90b6e8bab0f14e4764347d8c671152843
Opcode Fuzzy Hash: 7ba923b4aae9a320b3de7c7cc2e3cf7317f9ab3997d3f920a4b628c14e67f703
Instruction Fuzzy Hash: 4F11CDB6C003498ECB24CF9AD444A9EFBF4EB88324F24845AD529A7610D379A545CFA1

Function 05436D88 Relevance: .4, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c893d908a7742045cd09bf1a03ed5691b7c41e027df843cbb017665234fc102
Instruction ID: 32e4f2baa7ef2443e7bf5267591e4780a502a87e101957e7f939534bf31a31f8
Opcode Fuzzy Hash: 6c893d908a7742045cd09bf1a03ed5691b7c41e027df843cbb017665234fc102
Instruction Fuzzy Hash: 50E148757002159FDB14DFB8C899A6A7BB6FF89300F1584A9E50ACB3A2DE30ED41CB51

Function 05436098 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246862d7059f1d26bfe207ca840e678387a8064235a200277790a50651984d9d
Instruction ID: e1891e91a2811186d17931b08636337b3bdc67350249f5f29ab706887136abbc
Opcode Fuzzy Hash: 246862d7059f1d26bfe207ca840e678387a8064235a200277790a50651984d9d
Instruction Fuzzy Hash: CCE13D74A00206DFDB14DFA5D995A9EBBB2FF88310F158569E9069B361DB30EC41CF90

Function 05437C89 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be6be1c94b5a639f825d17118f0f491816807988ee2a8d4a686c5a5b53ca787
Instruction ID: 50f36e6e8bc28bae98251ce4fbf1e387f5c31e328046cfc78c91663b3c5756a2
Opcode Fuzzy Hash: 6be6be1c94b5a639f825d17118f0f491816807988ee2a8d4a686c5a5b53ca787
Instruction Fuzzy Hash: EED1F974A00219CFDB15DF64D859BAD7BB2FB88301F1084A9E90AAB3A5DF319D81CF50

Function 0543E4E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd20d755a5d0634d5e5e88e3a79e05461c8dfa37738952084c52cee60df40f0
Instruction ID: 2cd4f3596e7e8882bffe153fbc7cfad7c874f6bb462877f593e09d5265bf026a
Opcode Fuzzy Hash: 2fd20d755a5d0634d5e5e88e3a79e05461c8dfa37738952084c52cee60df40f0
Instruction Fuzzy Hash: 02714C34B012449FEB55DB69C459AAE7BF6BF8D310F1884A9E806DB3A1DE34DC41CB50

Function 0543B15F Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f37a11857a7cd65f54578a276f9b8b598dbd02a3a9fe2ef53537d8aeff168d
Instruction ID: 23977d49cb237cecd09bfd7d0f6bceb7e9aa90317cb9e7e4b42dd91d74663430
Opcode Fuzzy Hash: 90f37a11857a7cd65f54578a276f9b8b598dbd02a3a9fe2ef53537d8aeff168d
Instruction Fuzzy Hash: CB717E34A012059FDB18DF78D585AAEBBF2FF88300B64846AE905DB361DB30ED42DB51

Function 0543D120 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6f661921c37c2de5f86c46cc8cf90630c1a61bab00dd1adbbbd6741bbe5756
Instruction ID: b01ba4286441e6b419b51b3efbce3c2ac3b56df85fc1552efa9d136b77d810f2
Opcode Fuzzy Hash: dc6f661921c37c2de5f86c46cc8cf90630c1a61bab00dd1adbbbd6741bbe5756
Instruction Fuzzy Hash: 65511571E042569FDB08DB78D8957EA7FB2EF85350F08C4AAD4499B262EE30D806C791

Function 0543B818 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358c177661da096140721a1156fa9528415d75430dcfd49f072b1f8ef7da75d2
Instruction ID: ebc28c217a29c78822a2fa4040c8d33468c105b6ab2ba165c649b4a52dc3eedf
Opcode Fuzzy Hash: 358c177661da096140721a1156fa9528415d75430dcfd49f072b1f8ef7da75d2
Instruction Fuzzy Hash: 8B514B76A001059FDB04DF61CC80EEABBBAFF8C350B0181A5EA159B275EB35D912DB50

Function 05436459 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23140ecb337edd6382ead8a828ee5fa3a6af559d3235507e62bdfb9c011b4bd
Instruction ID: 51cacf5bf02269338bc37b9742ae6f940d71b8ca0772c6b29d3d45d0b3eab7e4
Opcode Fuzzy Hash: f23140ecb337edd6382ead8a828ee5fa3a6af559d3235507e62bdfb9c011b4bd
Instruction Fuzzy Hash: 7C51A334A00209DFDB14DFA4D995EAEBBB2FF88310F158559E916AB361CB31E842DF50

Function 0543B7CD Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7249d4c2b9609c30863ab7f56ea0afe1ce53fb758f0b1e76650bc51a79f4ce7
Instruction ID: 2f1aaf068d66c077c378066fe31539ab36833a3f7878bfaa8b9a8eed19e2daaa
Opcode Fuzzy Hash: a7249d4c2b9609c30863ab7f56ea0afe1ce53fb758f0b1e76650bc51a79f4ce7
Instruction Fuzzy Hash: EF41B175A00205DFDB04DFB4C885AEEBBB6FF89300F1580AAE905DB265EB31D942CB50

Function 0543F878 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d3f5094158c3809cdc0de6fc7248883daf32883400d9fa7ec48ecf86f02e83
Instruction ID: fe9ead6ca318d2a419a418453a3fcb41c37e6a0f8e93ed4f3d276b5c09b645cc
Opcode Fuzzy Hash: 57d3f5094158c3809cdc0de6fc7248883daf32883400d9fa7ec48ecf86f02e83
Instruction Fuzzy Hash: 0441C330B003559FEB18AB78942976E7BF2BF89300F1488AAE506D77D1EE349D41CB41

Function 0543EB97 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21e56dc75cde531bcf0e92d9be1ed614b4df9c9a4090338a8ba9f8bba1e3cef
Instruction ID: eaa155ff745b5d0e6be25b8aae0df714ca27e17d13c0e7ee5b1984bd27bc2771
Opcode Fuzzy Hash: c21e56dc75cde531bcf0e92d9be1ed614b4df9c9a4090338a8ba9f8bba1e3cef
Instruction Fuzzy Hash: 6D41E974A10504DFDB44DFA8D959B9DBBB2FF88304F1480A9E506AB3B1DB31AD41CB40

Function 0543F6F8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1203d7e178151907bcfb188e6197b89e3b4482a7ab3857f57aca86a60cab7890
Instruction ID: 83e92cbfcf2265fd2112917afe7c3ad8ad8bdf44a17b5c6a08c12172a5de371c
Opcode Fuzzy Hash: 1203d7e178151907bcfb188e6197b89e3b4482a7ab3857f57aca86a60cab7890
Instruction Fuzzy Hash: 5531D434B04200AFDB549BB8D45ABAE7FE6BF88300F144469E50AD7391DF349982CB91

Function 0097D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1995546557.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_97d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b39f08360ce85555f2fbcb004b926e8e9060b18fcb423d9eefc337ba7b9d66d
Instruction ID: e4ae3bbbaa961c09bc48ae048c358ef6be46781b5b8c153109ad65dc6fdc7a7e
Opcode Fuzzy Hash: 3b39f08360ce85555f2fbcb004b926e8e9060b18fcb423d9eefc337ba7b9d66d
Instruction Fuzzy Hash: AB2121B2504200DFCB05DF14C9C0B26BF79FF88328F24C969E9090A25AC33AD806CAA1

Function 05436E11 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1c3ab5b563ad7f9eb18b169ac9689ff2299356be2da36d42550de209b127cf
Instruction ID: f84645b89776d9ea2753b043b519b6586b4e80d8dfe53348367ef2362cf9cfa5
Opcode Fuzzy Hash: da1c3ab5b563ad7f9eb18b169ac9689ff2299356be2da36d42550de209b127cf
Instruction Fuzzy Hash: 8D216235700106AFDB10DF64C846AAF7BB6FF88350F1584AAE9169B375DB30D945CB90

Function 0098D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1995590539.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_98d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e8d91b6e3f5a5308e0b1efc3c5452339ec918db30658db89801c33b0c71b4
Instruction ID: b91ac453d84e45a800b9c52255caa552517301a46e698205373e5da8f7f066e8
Opcode Fuzzy Hash: d43e8d91b6e3f5a5308e0b1efc3c5452339ec918db30658db89801c33b0c71b4
Instruction Fuzzy Hash: 762122B1604200EFDB14EF14D9C0B26BB69FB84314F20C96DE80A4B386C33AD807CB61

Function 05438BC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898beb1823cdd1112dc457c01e8a76419946dacd681ca367e4ef0905ff5a9e43
Instruction ID: 6fcaac37a92e22fc609d58e3fab0653da6ddf32a37b20d32a377e938bde25e11
Opcode Fuzzy Hash: 898beb1823cdd1112dc457c01e8a76419946dacd681ca367e4ef0905ff5a9e43
Instruction Fuzzy Hash: 422181316001068FCB04EB79D986AAABBB6FF84200B148459E54D9B376DB30AD42CB51

Function 0098D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1995590539.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_98d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089817e4a97c556e25e59088938445a80019e051a2419788a41527d54ab63f3a
Instruction ID: d3ff6561d9e78684d6a8d0118e9ba32b0490668cbc64388af27b49fa519ee3af
Opcode Fuzzy Hash: 089817e4a97c556e25e59088938445a80019e051a2419788a41527d54ab63f3a
Instruction Fuzzy Hash: F6218E755093808FDB12DF24D990B15BF71EB46314F28C5EAD8498B6A7C33AD80ACB62

Function 05438BD0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948648a90814f3effaf210682e3b7bce25d01b5633bae00c012729f915034aa6
Instruction ID: d55c195d4de32fd44075ae85a6ff111dd7cea49793b5d5553157142a71d99db7
Opcode Fuzzy Hash: 948648a90814f3effaf210682e3b7bce25d01b5633bae00c012729f915034aa6
Instruction Fuzzy Hash: 40114C317001068FCB04EB69DA85AAEBBB6FF84200B14C569E50D9B375DB30ED45CB61

Function 0097D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1995546557.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_97d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 42dc77970e22c5f5ef5483b3f161ef4192a4519163e8df824be886229a62a4b8
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 3A11E676504280CFDB16CF14D5C4B16BF72FF94328F24C6A9E8494B65AC33AD85ACBA1

Function 0543E428 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868362de849174bbd042704ab7607dac8e81ecb29c6ea7846a1e659789e10afc
Instruction ID: 3891065fbc1cc054cbed4a7a55d4f7374bd5d8adf86bbfabc15cf6344bc3e378
Opcode Fuzzy Hash: 868362de849174bbd042704ab7607dac8e81ecb29c6ea7846a1e659789e10afc
Instruction Fuzzy Hash: FF117330B00208EFEB149BB8D41ABAD7FF6AF89301F5044A6E905D7391DE319D418B91

Function 0543E838 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cda499c33701979805db47466e64d9c66bad9fddda73ab8f38f6978af61be7
Instruction ID: f2601f1aee7c4c602fed4ab4750bf6561b5668aa2da25716f40ead9f437ec938
Opcode Fuzzy Hash: 78cda499c33701979805db47466e64d9c66bad9fddda73ab8f38f6978af61be7
Instruction Fuzzy Hash: 97118271E042288BDF19DB69D4165DEBBF5BF8D710F00856AD442B72A0DF70A948CBA0

Function 0543E828 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645240e831a89975902739d1bcfec7d04b5c6524048ec66c3b25a3e9f4f4b833
Instruction ID: 8df06efa3b826bfeebc9b7280d59627b5f7332dec0715053022747317d7815cb
Opcode Fuzzy Hash: 645240e831a89975902739d1bcfec7d04b5c6524048ec66c3b25a3e9f4f4b833
Instruction Fuzzy Hash: 0F119075E042188BDB19CB68C9066DEBBF5BF4D300F04856AD442B72A0DB74A988CBA0

Function 0097DA81 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1995546557.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_97d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c789e594b3cb02e965475de3dd051ad52a26cb049a008355ad7848db05877300
Instruction ID: 64664d708383ea0d4a0b227808df10e5708ad703464832856c9c00bfd1a8a5f7
Opcode Fuzzy Hash: c789e594b3cb02e965475de3dd051ad52a26cb049a008355ad7848db05877300
Instruction Fuzzy Hash: 4101F27200E3409AE7188A29C9C0B67BFBCFF41324F18C86AED0D5A282D7789C40C6B1

Function 0543D690 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9d61f3d2b6f9e046605fe31a0531fd6221ef57be1e7c2e0ec08fa65bd9a378
Instruction ID: f16028e67a3d6275cbcb65971f33267e62fb100d0cd349209a60466d3aa2ed0e
Opcode Fuzzy Hash: fc9d61f3d2b6f9e046605fe31a0531fd6221ef57be1e7c2e0ec08fa65bd9a378
Instruction Fuzzy Hash: 4601F2357002049BCB299B68E88ABBF3FAAEBC0711F044568F5079B381DE309806CB91

Function 0543D6A0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a086b982b145dd30185d62882f1add1d56cb1987019c743b47cec9112cab435e
Instruction ID: 12354b278ea5b816ab2c94c267202ad97e43f92740a9a3f97293deaada609d50
Opcode Fuzzy Hash: a086b982b145dd30185d62882f1add1d56cb1987019c743b47cec9112cab435e
Instruction Fuzzy Hash: 47F028357002009BCB189B65F84ABBF7BABEBC4750F048568F5078B380DF709805CB90

Function 0543D720 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec8b2cf5c016854b04e91ec09935906f8ca7dd9b317c90e9c06a163110da5d7
Instruction ID: 00a146a74c7081bcea7ff206ad1e67a325c35151e6b59e574df3a53f785dfeee
Opcode Fuzzy Hash: 9ec8b2cf5c016854b04e91ec09935906f8ca7dd9b317c90e9c06a163110da5d7
Instruction Fuzzy Hash: 6CF09035B542149BE718A6A8A85F7FA3A5AA748740F1400AAF64ACB2D1CF645C418BD0

Function 0097DA80 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1995546557.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_97d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472c47569b7ff42195e2d9b467c16cd822b11f281ee47887aba234ee8ce0183e
Instruction ID: b54aae7676ab9f36c2ef01cef7520c0654ade1d8c8a10c076ed7b40039344270
Opcode Fuzzy Hash: 472c47569b7ff42195e2d9b467c16cd822b11f281ee47887aba234ee8ce0183e
Instruction Fuzzy Hash: A0F062724093449EE7148A19D9C4B67FFACEF51734F18C45AED0C5A286D3799C44CA71

Function 0543F868 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca694902f49bfc6f8ae3aa0b5b03f9b98b3062581519fb47a306a69a8bd63b6
Instruction ID: 194c02c2fa7047cd590921cefb4691d4148ae03c228382856ff1c095241628a6
Opcode Fuzzy Hash: 4ca694902f49bfc6f8ae3aa0b5b03f9b98b3062581519fb47a306a69a8bd63b6
Instruction Fuzzy Hash: 9CF02835A04104FBDB1C8B58E412BE6BFB1FF49215F44849ED99E43A54C721B496CB80

Function 05437650 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd66d827d706e9a12ca234a0fdccb204476353a31dcfb2685a75fa6b5894001
Instruction ID: b9cdd4a1444efa9cbd251f5c108699c03ef0878ddef94d9ad93fb3b3a7cd6d21
Opcode Fuzzy Hash: 2bd66d827d706e9a12ca234a0fdccb204476353a31dcfb2685a75fa6b5894001
Instruction Fuzzy Hash: 48F02EB2A041599FDB11CE69EC657DABF79EB88350F0004BBE545E3340DA705954CB60

Function 0543F6E8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0906eb550df0934b4f365ca090353c7f22f0d76db1245f173245d165c7c03b0
Instruction ID: 8d48663641accd4d06d4890221ca06bdd40bb403b55b5d4ab0a6bc6a4714af1c
Opcode Fuzzy Hash: e0906eb550df0934b4f365ca090353c7f22f0d76db1245f173245d165c7c03b0
Instruction Fuzzy Hash: DFF0AB3120C2414FD7464B68E58DB9A3FB9AF00711B0510AFF087DBAB2EF209885CB41

Function 0543D8B2 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2002751296.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5430000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f9d234414e16aa6925a5136aa009355e3b305a973cd99868d01e3c78098b91
Instruction ID: c9ad77d50af54473c5a767e9526ac7e7445192e0bf7dfd6d861d32c25b4c3f60
Opcode Fuzzy Hash: c7f9d234414e16aa6925a5136aa009355e3b305a973cd99868d01e3c78098b91
Instruction Fuzzy Hash: 8DD0A778F142448BD759933C489A7663AB67789189FC400D6C6A783366DF24FD03DB61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cc2dcv04.rrt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duhjypiv.foh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3ymev40.pqy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zkhfamjp.oc5.psm1

C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

C:\Users\user\RFQ 10046335 PO 4502042346 PR 11148099 411128.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

Function 00007FF65F2B2B90 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Function 00007FF65F2A8130 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Function 00007FF65F30BDA4 Relevance: 3.2, APIs: 2, Instructions: 199
COMMONLIBRARYCODE

Function 00007FF65F370D30 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 00007FF65F2B2750 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96
COMMON

Function 00007FF65F2AD0F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Function 00007FF65F2A3630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82
sleepCOMMON

Function 00007FF65F2AD350 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Function 00007FF65F2B2570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Function 00007FF65F2B8DCB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106
COMMON

Function 00007FF65F2B2E10 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Function 00007FF65F2B2DD0 Relevance: 2.5, APIs: 2, Instructions: 17
memoryCOMMON

Function 00007FF65F34CFB0 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Function 00007FF65F2A2AB0 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre