Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1465684
MD5:	1b898df684811054d405e9c31fddd80a
SHA1:	9a322fd8e07427ce716f0dd9210ff563091e32de
SHA256:	7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

.NET source code contains very large strings

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

setup.exe (PID: 6868 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 1B898DF684811054D405E9C31FDDD80A)

conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "141.94.188.138:46419", "Bot Id": "pon"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xdd0:$a3: Software\Valve\SteamLogin Data 0x16874:$a4: get_ScannedWallets 0x153ce:$a5: get_ScanTelegram 0x163f4:$a6: get_ScanGeckoBrowsersPaths 0x13fcc:$a7: <Processes>k__BackingField 0x11c52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x13906:$a9: <ScanFTP>k__BackingField
00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x16f90:$a1: get_encrypted_key 0x1635f:$a2: get_PassedPaths 0x14913:$a3: ChromeGetLocalName 0x167ad:$a4: GetBrowsers 0xdd0:$a5: Software\Valve\SteamLogin Data 0x510:$a6: %appdata%\ 0x15e59:$a7: ScanPasswords
00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1331c:$u7: RunPE 0x16e59:$u8: DownloadAndEx 0x12e0:$pat14: , CommandLine: 0x161f4:$v2_1: ListOfProcesses 0x13578:$v2_2: get_ScanVPN 0x13655:$v2_2: get_ScanFTP 0x143b2:$v2_2: get_ScanDiscord 0x153b2:$v2_2: get_ScanSteam 0x153ce:$v2_2: get_ScanTelegram 0x1547f:$v2_2: get_ScanScreen 0x163bc:$v2_2: get_ScanChromeBrowsersPaths 0x163f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1678b:$v2_2: get_ScanBrowsers 0x16874:$v2_2: get_ScannedWallets 0x168c8:$v2_2: get_ScanWallets 0x168e8:$v2_3: GetArguments 0x14c3b:$v2_4: VerifyUpdate 0x16cce:$v2_5: VerifyScanRequest 0x1626a:$v2_6: GetUpdates 0x1985d:$v2_6: GetUpdates 0x15de0:$v4_3: base64str
00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xff060:$a3: Software\Valve\SteamLogin Data 0x11ac90:$a3: Software\Valve\SteamLogin Data 0x1368b0:$a3: Software\Valve\SteamLogin Data 0x114b04:$a4: get_ScannedWallets 0x130734:$a4: get_ScannedWallets 0x14c354:$a4: get_ScannedWallets 0x11365e:$a5: get_ScanTelegram 0x12f28e:$a5: get_ScanTelegram 0x14aeae:$a5: get_ScanTelegram 0x114684:$a6: get_ScanGeckoBrowsersPaths 0x1302b4:$a6: get_ScanGeckoBrowsersPaths 0x14bed4:$a6: get_ScanGeckoBrowsersPaths 0x11225c:$a7: <Processes>k__BackingField 0x12de8c:$a7: <Processes>k__BackingField 0x149aac:$a7: <Processes>k__BackingField 0x10fee2:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x12bb12:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x147732:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x111b96:$a9: <ScanFTP>k__BackingField 0x12d7c6:$a9: <ScanFTP>k__BackingField 0x1493e6:$a9: <ScanFTP>k__BackingField
00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x115220:$a1: get_encrypted_key 0x130e50:$a1: get_encrypted_key 0x14ca70:$a1: get_encrypted_key 0x1145ef:$a2: get_PassedPaths 0x13021f:$a2: get_PassedPaths 0x14be3f:$a2: get_PassedPaths 0x112ba3:$a3: ChromeGetLocalName 0x12e7d3:$a3: ChromeGetLocalName 0x14a3f3:$a3: ChromeGetLocalName 0x114a3d:$a4: GetBrowsers 0x13066d:$a4: GetBrowsers 0x14c28d:$a4: GetBrowsers 0xff060:$a5: Software\Valve\SteamLogin Data 0x11ac90:$a5: Software\Valve\SteamLogin Data 0x1368b0:$a5: Software\Valve\SteamLogin Data 0xfe7a0:$a6: %appdata%\ 0x11a3d0:$a6: %appdata%\ 0x135ff0:$a6: %appdata%\ 0x1140e9:$a7: ScanPasswords 0x12fd19:$a7: ScanPasswords 0x14b939:$a7: ScanPasswords
Process Memory Space: setup.exe PID: 6868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: setup.exe PID: 6868	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: setup.exe PID: 6868	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x7a17f:$a4: get_ScannedWallets 0x96f1b:$a4: get_ScannedWallets 0x78d27:$a5: get_ScanTelegram 0x95ac3:$a5: get_ScanTelegram 0x79d09:$a6: get_ScanGeckoBrowsersPaths 0x96aa5:$a6: get_ScanGeckoBrowsersPaths 0x7797f:$a7: <Processes>k__BackingField 0x9471b:$a7: <Processes>k__BackingField 0x74a84:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x91820:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x772b9:$a9: <ScanFTP>k__BackingField 0x94055:$a9: <ScanFTP>k__BackingField
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.setup.exe.3dc6ae0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.3dc6ae0.1.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x14a74:$a4: get_ScannedWallets 0x135ce:$a5: get_ScanTelegram 0x145f4:$a6: get_ScanGeckoBrowsersPaths 0x121cc:$a7: <Processes>k__BackingField 0xfe52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11b06:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.3dc6ae0.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1151c:$u7: RunPE 0x15059:$u8: DownloadAndEx 0x143f4:$v2_1: ListOfProcesses 0x11778:$v2_2: get_ScanVPN 0x11855:$v2_2: get_ScanFTP 0x125b2:$v2_2: get_ScanDiscord 0x135b2:$v2_2: get_ScanSteam 0x135ce:$v2_2: get_ScanTelegram 0x1367f:$v2_2: get_ScanScreen 0x145bc:$v2_2: get_ScanChromeBrowsersPaths 0x145f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1498b:$v2_2: get_ScanBrowsers 0x14a74:$v2_2: get_ScannedWallets 0x14ac8:$v2_2: get_ScanWallets 0x14ae8:$v2_3: GetArguments 0x12e3b:$v2_4: VerifyUpdate 0x14ece:$v2_5: VerifyScanRequest 0x1446a:$v2_6: GetUpdates 0x17a5d:$v2_6: GetUpdates 0x13fe0:$v4_3: base64str 0x1513d:$v4_4: stringKey
0.2.setup.exe.53b0000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.53b0000.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x14a74:$a4: get_ScannedWallets 0x135ce:$a5: get_ScanTelegram 0x145f4:$a6: get_ScanGeckoBrowsersPaths 0x121cc:$a7: <Processes>k__BackingField 0xfe52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11b06:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.53b0000.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1151c:$u7: RunPE 0x15059:$u8: DownloadAndEx 0x143f4:$v2_1: ListOfProcesses 0x11778:$v2_2: get_ScanVPN 0x11855:$v2_2: get_ScanFTP 0x125b2:$v2_2: get_ScanDiscord 0x135b2:$v2_2: get_ScanSteam 0x135ce:$v2_2: get_ScanTelegram 0x1367f:$v2_2: get_ScanScreen 0x145bc:$v2_2: get_ScanChromeBrowsersPaths 0x145f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1498b:$v2_2: get_ScanBrowsers 0x14a74:$v2_2: get_ScannedWallets 0x14ac8:$v2_2: get_ScanWallets 0x14ae8:$v2_3: GetArguments 0x12e3b:$v2_4: VerifyUpdate 0x14ece:$v2_5: VerifyScanRequest 0x1446a:$v2_6: GetUpdates 0x17a5d:$v2_6: GetUpdates 0x13fe0:$v4_3: base64str 0x1513d:$v4_4: stringKey
0.2.setup.exe.3daaec0.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.setup.exe.3daaec0.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.3daaec0.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1abf0:$a3: Software\Valve\SteamLogin Data 0x14a74:$a4: get_ScannedWallets 0x135ce:$a5: get_ScanTelegram 0x145f4:$a6: get_ScanGeckoBrowsersPaths 0x121cc:$a7: <Processes>k__BackingField 0xfe52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11b06:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.3daaec0.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x15190:$a1: get_encrypted_key 0x1455f:$a2: get_PassedPaths 0x12b13:$a3: ChromeGetLocalName 0x149ad:$a4: GetBrowsers 0x1abf0:$a5: Software\Valve\SteamLogin Data 0x1a330:$a6: %appdata%\ 0x14059:$a7: ScanPasswords
0.2.setup.exe.3daaec0.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1151c:$u7: RunPE 0x15059:$u8: DownloadAndEx 0x1b100:$pat14: , CommandLine: 0x143f4:$v2_1: ListOfProcesses 0x11778:$v2_2: get_ScanVPN 0x11855:$v2_2: get_ScanFTP 0x125b2:$v2_2: get_ScanDiscord 0x135b2:$v2_2: get_ScanSteam 0x135ce:$v2_2: get_ScanTelegram 0x1367f:$v2_2: get_ScanScreen 0x145bc:$v2_2: get_ScanChromeBrowsersPaths 0x145f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1498b:$v2_2: get_ScanBrowsers 0x14a74:$v2_2: get_ScannedWallets 0x14ac8:$v2_2: get_ScanWallets 0x14ae8:$v2_3: GetArguments 0x12e3b:$v2_4: VerifyUpdate 0x14ece:$v2_5: VerifyScanRequest 0x1446a:$v2_6: GetUpdates 0x17a5d:$v2_6: GetUpdates 0x13fe0:$v4_3: base64str
0.2.setup.exe.3dc6ae0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.setup.exe.3dc6ae0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.3dc6ae0.1.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xdd0:$a3: Software\Valve\SteamLogin Data 0x16874:$a4: get_ScannedWallets 0x153ce:$a5: get_ScanTelegram 0x163f4:$a6: get_ScanGeckoBrowsersPaths 0x13fcc:$a7: <Processes>k__BackingField 0x11c52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x13906:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.3dc6ae0.1.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x16f90:$a1: get_encrypted_key 0x1635f:$a2: get_PassedPaths 0x14913:$a3: ChromeGetLocalName 0x167ad:$a4: GetBrowsers 0xdd0:$a5: Software\Valve\SteamLogin Data 0x510:$a6: %appdata%\ 0x15e59:$a7: ScanPasswords
0.2.setup.exe.3dc6ae0.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1331c:$u7: RunPE 0x16e59:$u8: DownloadAndEx 0x12e0:$pat14: , CommandLine: 0x161f4:$v2_1: ListOfProcesses 0x13578:$v2_2: get_ScanVPN 0x13655:$v2_2: get_ScanFTP 0x143b2:$v2_2: get_ScanDiscord 0x153b2:$v2_2: get_ScanSteam 0x153ce:$v2_2: get_ScanTelegram 0x1547f:$v2_2: get_ScanScreen 0x163bc:$v2_2: get_ScanChromeBrowsersPaths 0x163f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1678b:$v2_2: get_ScanBrowsers 0x16874:$v2_2: get_ScannedWallets 0x168c8:$v2_2: get_ScanWallets 0x168e8:$v2_3: GetArguments 0x14c3b:$v2_4: VerifyUpdate 0x16cce:$v2_5: VerifyScanRequest 0x1626a:$v2_6: GetUpdates 0x1985d:$v2_6: GetUpdates 0x15de0:$v4_3: base64str
0.2.setup.exe.53b0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.setup.exe.53b0000.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.53b0000.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xdd0:$a3: Software\Valve\SteamLogin Data 0x16874:$a4: get_ScannedWallets 0x153ce:$a5: get_ScanTelegram 0x163f4:$a6: get_ScanGeckoBrowsersPaths 0x13fcc:$a7: <Processes>k__BackingField 0x11c52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x13906:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.53b0000.3.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x16f90:$a1: get_encrypted_key 0x1635f:$a2: get_PassedPaths 0x14913:$a3: ChromeGetLocalName 0x167ad:$a4: GetBrowsers 0xdd0:$a5: Software\Valve\SteamLogin Data 0x510:$a6: %appdata%\ 0x15e59:$a7: ScanPasswords
0.2.setup.exe.53b0000.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1331c:$u7: RunPE 0x16e59:$u8: DownloadAndEx 0x12e0:$pat14: , CommandLine: 0x161f4:$v2_1: ListOfProcesses 0x13578:$v2_2: get_ScanVPN 0x13655:$v2_2: get_ScanFTP 0x143b2:$v2_2: get_ScanDiscord 0x153b2:$v2_2: get_ScanSteam 0x153ce:$v2_2: get_ScanTelegram 0x1547f:$v2_2: get_ScanScreen 0x163bc:$v2_2: get_ScanChromeBrowsersPaths 0x163f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1678b:$v2_2: get_ScanBrowsers 0x16874:$v2_2: get_ScannedWallets 0x168c8:$v2_2: get_ScanWallets 0x168e8:$v2_3: GetArguments 0x14c3b:$v2_4: VerifyUpdate 0x16cce:$v2_5: VerifyScanRequest 0x1626a:$v2_6: GetUpdates 0x1985d:$v2_6: GetUpdates 0x15de0:$v4_3: base64str
0.2.setup.exe.3d8f290.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.setup.exe.3d8f290.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.3d8f290.2.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1ac00:$a3: Software\Valve\SteamLogin Data 0x14a74:$a4: get_ScannedWallets 0x135ce:$a5: get_ScanTelegram 0x145f4:$a6: get_ScanGeckoBrowsersPaths 0x121cc:$a7: <Processes>k__BackingField 0xfe52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11b06:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.3d8f290.2.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x15190:$a1: get_encrypted_key 0x1455f:$a2: get_PassedPaths 0x12b13:$a3: ChromeGetLocalName 0x149ad:$a4: GetBrowsers 0x1ac00:$a5: Software\Valve\SteamLogin Data 0x1a340:$a6: %appdata%\ 0x14059:$a7: ScanPasswords
0.2.setup.exe.3d8f290.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1151c:$u7: RunPE 0x15059:$u8: DownloadAndEx 0x1b110:$pat14: , CommandLine: 0x143f4:$v2_1: ListOfProcesses 0x11778:$v2_2: get_ScanVPN 0x11855:$v2_2: get_ScanFTP 0x125b2:$v2_2: get_ScanDiscord 0x135b2:$v2_2: get_ScanSteam 0x135ce:$v2_2: get_ScanTelegram 0x1367f:$v2_2: get_ScanScreen 0x145bc:$v2_2: get_ScanChromeBrowsersPaths 0x145f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1498b:$v2_2: get_ScanBrowsers 0x14a74:$v2_2: get_ScannedWallets 0x14ac8:$v2_2: get_ScanWallets 0x14ae8:$v2_3: GetArguments 0x12e3b:$v2_4: VerifyUpdate 0x14ece:$v2_5: VerifyScanRequest 0x1446a:$v2_6: GetUpdates 0x17a5d:$v2_6: GetUpdates 0x13fe0:$v4_3: base64str
0.2.setup.exe.3daaec0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.setup.exe.3daaec0.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.3daaec0.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xdd0:$a3: Software\Valve\SteamLogin Data 0x1c9f0:$a3: Software\Valve\SteamLogin Data 0x16874:$a4: get_ScannedWallets 0x32494:$a4: get_ScannedWallets 0x153ce:$a5: get_ScanTelegram 0x30fee:$a5: get_ScanTelegram 0x163f4:$a6: get_ScanGeckoBrowsersPaths 0x32014:$a6: get_ScanGeckoBrowsersPaths 0x13fcc:$a7: <Processes>k__BackingField 0x2fbec:$a7: <Processes>k__BackingField 0x11c52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x2d872:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x13906:$a9: <ScanFTP>k__BackingField 0x2f526:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.3daaec0.0.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x16f90:$a1: get_encrypted_key 0x32bb0:$a1: get_encrypted_key 0x1635f:$a2: get_PassedPaths 0x31f7f:$a2: get_PassedPaths 0x14913:$a3: ChromeGetLocalName 0x30533:$a3: ChromeGetLocalName 0x167ad:$a4: GetBrowsers 0x323cd:$a4: GetBrowsers 0xdd0:$a5: Software\Valve\SteamLogin Data 0x1c9f0:$a5: Software\Valve\SteamLogin Data 0x510:$a6: %appdata%\ 0x1c130:$a6: %appdata%\ 0x15e59:$a7: ScanPasswords 0x31a79:$a7: ScanPasswords
0.2.setup.exe.3daaec0.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1331c:$u7: RunPE 0x2ef3c:$u7: RunPE 0x16e59:$u8: DownloadAndEx 0x32a79:$u8: DownloadAndEx 0x12e0:$pat14: , CommandLine: 0x1cf00:$pat14: , CommandLine: 0x161f4:$v2_1: ListOfProcesses 0x31e14:$v2_1: ListOfProcesses 0x13578:$v2_2: get_ScanVPN 0x13655:$v2_2: get_ScanFTP 0x143b2:$v2_2: get_ScanDiscord 0x153b2:$v2_2: get_ScanSteam 0x153ce:$v2_2: get_ScanTelegram 0x1547f:$v2_2: get_ScanScreen 0x163bc:$v2_2: get_ScanChromeBrowsersPaths 0x163f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1678b:$v2_2: get_ScanBrowsers 0x16874:$v2_2: get_ScannedWallets 0x168c8:$v2_2: get_ScanWallets 0x2f198:$v2_2: get_ScanVPN 0x2f275:$v2_2: get_ScanFTP
0.2.setup.exe.3d8f290.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.setup.exe.3d8f290.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.3d8f290.2.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xdd0:$a3: Software\Valve\SteamLogin Data 0x1ca00:$a3: Software\Valve\SteamLogin Data 0x38620:$a3: Software\Valve\SteamLogin Data 0x16874:$a4: get_ScannedWallets 0x324a4:$a4: get_ScannedWallets 0x4e0c4:$a4: get_ScannedWallets 0x153ce:$a5: get_ScanTelegram 0x30ffe:$a5: get_ScanTelegram 0x4cc1e:$a5: get_ScanTelegram 0x163f4:$a6: get_ScanGeckoBrowsersPaths 0x32024:$a6: get_ScanGeckoBrowsersPaths 0x4dc44:$a6: get_ScanGeckoBrowsersPaths 0x13fcc:$a7: <Processes>k__BackingField 0x2fbfc:$a7: <Processes>k__BackingField 0x4b81c:$a7: <Processes>k__BackingField 0x11c52:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x2d882:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x494a2:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x13906:$a9: <ScanFTP>k__BackingField 0x2f536:$a9: <ScanFTP>k__BackingField 0x4b156:$a9: <ScanFTP>k__BackingField
0.2.setup.exe.3d8f290.2.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x16f90:$a1: get_encrypted_key 0x32bc0:$a1: get_encrypted_key 0x4e7e0:$a1: get_encrypted_key 0x1635f:$a2: get_PassedPaths 0x31f8f:$a2: get_PassedPaths 0x4dbaf:$a2: get_PassedPaths 0x14913:$a3: ChromeGetLocalName 0x30543:$a3: ChromeGetLocalName 0x4c163:$a3: ChromeGetLocalName 0x167ad:$a4: GetBrowsers 0x323dd:$a4: GetBrowsers 0x4dffd:$a4: GetBrowsers 0xdd0:$a5: Software\Valve\SteamLogin Data 0x1ca00:$a5: Software\Valve\SteamLogin Data 0x38620:$a5: Software\Valve\SteamLogin Data 0x510:$a6: %appdata%\ 0x1c140:$a6: %appdata%\ 0x37d60:$a6: %appdata%\ 0x15e59:$a7: ScanPasswords 0x31a89:$a7: ScanPasswords 0x4d6a9:$a7: ScanPasswords
0.2.setup.exe.3d8f290.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1331c:$u7: RunPE 0x2ef4c:$u7: RunPE 0x4ab6c:$u7: RunPE 0x16e59:$u8: DownloadAndEx 0x32a89:$u8: DownloadAndEx 0x4e6a9:$u8: DownloadAndEx 0x12e0:$pat14: , CommandLine: 0x1cf10:$pat14: , CommandLine: 0x38b30:$pat14: , CommandLine: 0x161f4:$v2_1: ListOfProcesses 0x31e24:$v2_1: ListOfProcesses 0x4da44:$v2_1: ListOfProcesses 0x13578:$v2_2: get_ScanVPN 0x13655:$v2_2: get_ScanFTP 0x143b2:$v2_2: get_ScanDiscord 0x153b2:$v2_2: get_ScanSteam 0x153ce:$v2_2: get_ScanTelegram 0x1547f:$v2_2: get_ScanScreen 0x163bc:$v2_2: get_ScanChromeBrowsersPaths 0x163f4:$v2_2: get_ScanGeckoBrowsersPaths 0x1678b:$v2_2: get_ScanBrowsers
Click to see the 31 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: setup.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "141.94.188.138:46419", "Bot Id": "pon"}

Multi AV Scanner detection for submitted file

Source: setup.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: setup.exe

Joe Sandbox ML: detected

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb9 source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2899543825.00000000055FF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdbd source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 141.94.188.138:46419

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 141.94.188.138:46419

Source: Joe Sandbox View

IP Address: 141.94.188.138 141.94.188.138

Source: Joe Sandbox View

ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese

Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138
Source: unknown	TCP traffic detected without corresponding DNS query: 141.94.188.138

Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/AckRequested
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CloseSequence
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CloseSequenceResponse
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequenceResponse
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/SequenceAcknowledgement
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequence
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequenceResponse
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-rx/wsrm/200702/fault
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/sct
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512#BinarySecret
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/AsymmetricKey
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/CK/PSHA1
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Cancel
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Nonce
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Cancel
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Renew
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Cancel
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Issueh
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Renew
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Cancel
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Renew
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Renew
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Aborted
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Commit
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Committed
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Completion
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Durable2PC
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Prepare
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Prepared
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/ReadOnly
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Replay
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Rollback
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/Volatile2PC
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wsat/2006/06/fault
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContext
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContextResponse
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/Register
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/RegisterResponse
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-tx/wscoor/2006/06/fault
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmd
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKeyD
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/8
Source: setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/ConfirmLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/ConfirmResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitDisplayLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitDisplayResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/InitResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartBrowsersLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartBrowsersResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartColdWalletsLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartColdWalletsResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDefendersLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDefendersResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDiscordLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartDiscordResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartFtpConnectionsLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartFtpConnectionsResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartHardwaresLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartHardwaresResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledBrowsersLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledBrowsersResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledSoftwaresLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartInstalledSoftwaresResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartLanguagesLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartLanguagesResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartNordVPNLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartNordVPNResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartOpenVPNLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartOpenVPNResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProcessesLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProcessesResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProtonVPNLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartProtonVPNResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartScannedFilesLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartScannedFilesResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartSteamFilesLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartSteamFilesResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartTelegramFilesLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/PartTelegramFilesResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateLR
Source: setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponseX
Source: setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/h
Source: setup.exe, 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.setup.exe.3dc6ae0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.3dc6ae0.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.53b0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.53b0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: Process Memory Space: setup.exe PID: 6868, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

.NET source code contains very large strings

Source: setup.exe, Option.cs

Long String: Length: 151576

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_05263F30		0_2_05263F30
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_05263F20		0_2_05263F20

Source: setup.exe, 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOverpaints.exe4 vs setup.exe
Source: setup.exe, 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOverpaints.exe4 vs setup.exe
Source: setup.exe, 00000000.00000002.2897450427.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs setup.exe
Source: setup.exe, 00000000.00000000.1642969891.0000000000918000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRegAsm.exeT vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameRegAsm.exeT vs setup.exe

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.setup.exe.3dc6ae0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.3dc6ae0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.53b0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.53b0000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: Process Memory Space: setup.exe PID: 6868, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: 0.2.setup.exe.3d8f290.2.raw.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbg=='
Source: 0.2.setup.exe.53b0000.3.raw.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbg=='
Source: 0.2.setup.exe.3daaec0.0.raw.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbg=='
Source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbg=='

Source: classification engine

Classification label: mal96.troj.winEXE@2/0@0/1

Source: C:\Users\user\Desktop\setup.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_03

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: setup.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb9 source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2899543825.00000000055FF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdbd source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Memory allocated: 1070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory allocated: 4C90000 memory reserve \| memory write watch	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: setup.exe, 00000000.00000002.2897450427.0000000000F05000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWWa

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\Desktop\setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.setup.exe.3dc6ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.53b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 6868, type: MEMORYSTR

Source: Yara match	File source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 6868, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.setup.exe.3dc6ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.53b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3daaec0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3dc6ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.53b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3d8f290.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3daaec0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3d8f290.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 6868, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
setup.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.RelineStealer
setup.exe	100%	Avira	HEUR/AGEN.1310137
setup.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequenceResponse	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequenceResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/ConfirmResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartInstalledBrowsersLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartDiscordLR	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/CloseSequenceResponse	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wscoor/2006/06	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponseX	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponseX	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartLanguagesLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartInstalledSoftwaresResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartLanguagesResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Cancel	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesLR	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartColdWalletsLR	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/fault	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/AsymmetricKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/SequenceAcknowledgement	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/CK/PSHA1	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Replay	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/h	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Aborted	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Cancel	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContext	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/InitDisplayLR	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Volatile2PC	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Prepared	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartScannedFilesResponseX	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartDefendersResponseX	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartHardwaresLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartScannedFilesLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartHardwaresResponseX	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartProtonVPNLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartTelegramFilesLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartNordVPNLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/InitDisplayResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartTelegramFilesResponseX	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartProcessesResponseX	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartInstalledSoftwaresLR	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/sct	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/ReadOnly	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartInstalledBrowsersResponseX	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartOpenVPNResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/fault	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequence	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartProcessesLR	0%	Avira URL Cloud	safe
http://tempuri.org/8	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-rx/wsrm/200702/AckRequested	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartColdWalletsResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/RegisterResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartProtonVPNResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Completion	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartSteamFilesLR	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/InitLR	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartSteamFilesResponseX	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Commit	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateLR	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/PartFtpConnectionsLR	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequenceResponse	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/fault	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequenceResponse	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/CloseSequenceResponse	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartInstalledBrowsersLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/ConfirmResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartDiscordLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wscoor/2006/06	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartLanguagesResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartLanguagesLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartInstalledSoftwaresResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Cancel	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Cancel	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartColdWalletsLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/fault	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/AsymmetricKey	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/SequenceAcknowledgement	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/CK/PSHA1	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Replay	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Aborted	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/h	setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	setup.exe, 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Cancel	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContext	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/InitDisplayLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/CreateCoordinationContextResponse	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Prepared	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Volatile2PC	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/PartScannedFilesResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartDefendersResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartHardwaresLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartScannedFilesLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartHardwaresResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartTelegramFilesLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartProtonVPNLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartNordVPNLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/InitDisplayResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartProcessesResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartTelegramFilesResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartInstalledSoftwaresLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Durable2PC	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/sct	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/ReadOnly	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnectLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartInstalledBrowsersResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartOpenVPNResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/fault	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Cancel	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/8	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/TerminateSequence	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartProcessesLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-rx/wsrm/200702/AckRequested	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartColdWalletsResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartProtonVPNResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/RegisterResponse	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wscoor/2006/06/Register	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/InitLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Completion	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartSteamFilesLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartSteamFilesResponseX	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-tx/wsat/2006/06/Commit	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/PartFtpConnectionsLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateLR	setup.exe, 00000000.00000002.2898257234.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2898257234.0000000002E42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/SCT/Renew	setup.exe, 00000000.00000002.2898257234.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.94.188.138	unknown	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465684
Start date and time:	2024-07-02 00:10:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@2/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: setup.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.94.188.138	P4ci8kzzCS.exe	Get hash	malicious	Unknown	Browse
	dMP72tpVfm.exe	Get hash	malicious	RedLine	Browse
	2pk95s5cp8.exe	Get hash	malicious	RedLine	Browse
	PvDxVI8pnQ.exe	Get hash	malicious	RedLine	Browse
	5b0d0BO1GN.exe	Get hash	malicious	RedLine	Browse
	569vj51Zrs.exe	Get hash	malicious	RedLine	Browse
	Loader.exe	Get hash	malicious	RedLine Xmrig	Browse
	rWdOgpdk5S.exe	Get hash	malicious	BitCoin Miner RedLine	Browse
	kqlzJ6RHp3.exe	Get hash	malicious	Phoenix Miner RedLine	Browse
	SecuriteInfo.com.Variant.Razy.934040.7155.exe	Get hash	malicious	BitCoin Miner RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	16bfcGvz5N.elf	Get hash	malicious	Unknown	Browse	141.36.163.13
	NiAsQEhh9p.elf	Get hash	malicious	Mirai	Browse	130.149.161.102
	BNd5XPrLzR.elf	Get hash	malicious	Mirai, Moobot	Browse	141.74.62.234
	QewpDKdeRJ.elf	Get hash	malicious	Mirai, Moobot	Browse	141.57.210.92
	BviOG97ArX.elf	Get hash	malicious	Mirai, Moobot	Browse	139.6.26.156
	DCwYFBy6z7.elf	Get hash	malicious	Mirai, Moobot	Browse	141.46.56.218
	owONvNMYXu.elf	Get hash	malicious	Mirai	Browse	193.175.239.107
	NgAzrOQSgK.elf	Get hash	malicious	Mirai	Browse	141.94.8.194
	botx.mips.elf	Get hash	malicious	Mirai	Browse	130.149.196.41
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	141.41.112.213

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.4333444163827895
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	setup.exe
File size:	420'864 bytes
MD5:	1b898df684811054d405e9c31fddd80a
SHA1:	9a322fd8e07427ce716f0dd9210ff563091e32de
SHA256:	7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92
SHA512:	c154faa686a30957718af46ab2150b1241d783025505b53adac9667af7e9d45ed4f08f22ffc6c45d0c9c47f070f427c5467600839aa94a3718719b7ec80e9be5
SSDEEP:	6144:ir2uImjz71CmoNwemgkFfsQzGtvSiFsbHTYTS2wvp8GIUnl2:+Wmf7poNweTkFkQzkvSrDWS2wvp8enk
TLSH:	77943A242AEA5019F1F3AF755AE47C96892FBE232A02945D10913F4B3633E80DDD15FE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..T..........^r... ........@.. ....................................`................................

File Icon


Icon Hash:	1862606d71614638

Static PE Info

General

Entrypoint:	0x45725e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DDA3CC8 [Sun Nov 24 08:18:16 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x57210	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x11210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x55264	0x55400	10a0f0b862ca7658f5c9902ef43bfac0	False	0.47189447397360706	data	4.334177045687271	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x58000	0x11210	0x11400	9d59e5121f47b10bbbbe9da069aa3a30	False	0.04787986865942029	data	2.434935814406297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6a000	0xc	0x200	53c8b9f8ba43f37d8f4671ea00c69661	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x58140	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m			0.03247367798414764
RT_GROUP_ICON	0x68968	0x14	data			1.15
RT_VERSION	0x6897c	0x400	data	English	United States	0.4521484375
RT_MANIFEST	0x68d7c	0x494	exported SGML document, ASCII text	English	United States	0.39334470989761094

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:10:57.726102114 CEST	49730	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:10:57.734750986 CEST	46419	49730	141.94.188.138	192.168.2.4
Jul 2, 2024 00:10:57.734946966 CEST	49730	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:10:57.748236895 CEST	49730	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:10:57.753906012 CEST	46419	49730	141.94.188.138	192.168.2.4
Jul 2, 2024 00:11:19.137522936 CEST	46419	49730	141.94.188.138	192.168.2.4
Jul 2, 2024 00:11:19.137595892 CEST	49730	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:19.332036972 CEST	49730	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:24.428381920 CEST	49737	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:24.433247089 CEST	46419	49737	141.94.188.138	192.168.2.4
Jul 2, 2024 00:11:24.435444117 CEST	49737	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:24.435740948 CEST	49737	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:24.440557957 CEST	46419	49737	141.94.188.138	192.168.2.4
Jul 2, 2024 00:11:45.825390100 CEST	46419	49737	141.94.188.138	192.168.2.4
Jul 2, 2024 00:11:45.825541019 CEST	49737	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:45.825870991 CEST	49737	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:50.833225965 CEST	49738	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:50.838202000 CEST	46419	49738	141.94.188.138	192.168.2.4
Jul 2, 2024 00:11:50.838295937 CEST	49738	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:50.838628054 CEST	49738	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:11:50.843353033 CEST	46419	49738	141.94.188.138	192.168.2.4
Jul 2, 2024 00:12:12.214536905 CEST	46419	49738	141.94.188.138	192.168.2.4
Jul 2, 2024 00:12:12.214721918 CEST	49738	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:12.214876890 CEST	49738	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:17.224348068 CEST	49740	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:17.231038094 CEST	46419	49740	141.94.188.138	192.168.2.4
Jul 2, 2024 00:12:17.231144905 CEST	49740	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:17.234318018 CEST	49740	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:17.241029978 CEST	46419	49740	141.94.188.138	192.168.2.4
Jul 2, 2024 00:12:38.620222092 CEST	46419	49740	141.94.188.138	192.168.2.4
Jul 2, 2024 00:12:38.620346069 CEST	49740	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:38.620582104 CEST	49740	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:43.630600929 CEST	49741	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:43.640567064 CEST	46419	49741	141.94.188.138	192.168.2.4
Jul 2, 2024 00:12:43.640835047 CEST	49741	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:43.641325951 CEST	49741	46419	192.168.2.4	141.94.188.138
Jul 2, 2024 00:12:43.648879051 CEST	46419	49741	141.94.188.138	192.168.2.4

Target ID:	0
Start time:	18:10:56
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0x8b0000
File size:	420'864 bytes
MD5 hash:	1B898DF684811054D405E9C31FDDD80A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000000.00000002.2899290245.00000000053B0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000000.00000002.2898610137.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	18:10:56
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	0

Executed Functions

Function 05263F30 Relevance: 6.2, Strings: 1, Instructions: 4951COMMON

Download Yara Rule

Strings

45_q, xrefs: 05268D23

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID: 45_q
API String ID: 0-1720489888
Opcode ID: 5e675b6861d3a738efad15f40f25a6a208ead22306994d03baec08db6f61444e
Instruction ID: e7c7eb2c44df832773cfe55705176436d46155dcc2697fa62cee995f0fa46c30
Opcode Fuzzy Hash: 5e675b6861d3a738efad15f40f25a6a208ead22306994d03baec08db6f61444e
Instruction Fuzzy Hash: D2A31D31E90B1B95EB209B60CC91BD5F371AF99700F60C746B6587A5C4EBB0BAC5CB84

Function 05263F20 Relevance: 6.2, Strings: 1, Instructions: 4924COMMON

Download Yara Rule

Strings

45_q, xrefs: 05268D23

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID: 45_q
API String ID: 0-1720489888
Opcode ID: 0b20501476d93923e7be4e0113445e6a4821389db48e4a49c02100b88ffaa6ab
Instruction ID: b75ee30994006993446bb4e2163b39854504ab75d3754083396b02b31c01670e
Opcode Fuzzy Hash: 0b20501476d93923e7be4e0113445e6a4821389db48e4a49c02100b88ffaa6ab
Instruction Fuzzy Hash: 95A31D31E90B1B95EB209B60CC91BD5F371AF99700F60C746B6587A5C4EBB0BAC5CB84

Function 010715F0 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 01071657

Memory Dump Source

Source File: 00000000.00000002.2897833944.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_setup.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 5b5535fdf88e5b73014f8040a1b8e79784eae914053b2f1b3d080ea2472bb960
Instruction ID: 01ed4b181084badcb693bb687c46fc7e9b414907fe972bb31c80d1468477a807
Opcode Fuzzy Hash: 5b5535fdf88e5b73014f8040a1b8e79784eae914053b2f1b3d080ea2472bb960
Instruction Fuzzy Hash: E51166B0D003098FCB20DFAAC4457DEFBF4EF88324F20881AC059A7280D734A944CB94

Function 010715F8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 01071657

Memory Dump Source

Source File: 00000000.00000002.2897833944.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_setup.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 504f4bc2572c679e8b11dcd20e35d1d5d94dc400991b29ff4c1623396766d25b
Instruction ID: 75867ba749eae07a685e0a5f2a85a5a0448504eea413e64e9a284ea9443ef9a8
Opcode Fuzzy Hash: 504f4bc2572c679e8b11dcd20e35d1d5d94dc400991b29ff4c1623396766d25b
Instruction Fuzzy Hash: 131136B1D003098FCB14DFAAC4457DEFBF4EB88324F24841AC559A7240CB34A544CB94

Function 0526A0B8 Relevance: 1.4, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 0526A0CC

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 19a322d661d90c251eeeabc5bd82ce6777da48a8641497de1f3312e7ab299c18
Instruction ID: 9e1746a2bf4729a690e89ff7f76fccb860b5df08ee529be7e10baac9ba71e4de
Opcode Fuzzy Hash: 19a322d661d90c251eeeabc5bd82ce6777da48a8641497de1f3312e7ab299c18
Instruction Fuzzy Hash: 9E519031B106169FC714DF69C88096EFBF5FF84320B55866AE41DEB391DB70AC818B94

Function 0526A0AA Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 0526A0CC

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 8082937559aa04701330a42eb2391acdc75b79592b9cc6de01c50750a8e899d4
Instruction ID: 7c251ca2eb63e5b1bce5c59a6b627ef387d1b20c4e49976176466fba8364348c
Opcode Fuzzy Hash: 8082937559aa04701330a42eb2391acdc75b79592b9cc6de01c50750a8e899d4
Instruction Fuzzy Hash: DD217170A10616DFCB08DF68C48096EFBB5FF48310F508669E469EB381DB70A985CBD0

Function 0526EB08 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040293baeb9fbe3403667552cb34674ec40cd8bc63e4cc90be9f9869947e00db
Instruction ID: dd8bb1a26e3b2e323e1c232b4d8db34b7056e04ca4586f76774d83d4f2fd555a
Opcode Fuzzy Hash: 040293baeb9fbe3403667552cb34674ec40cd8bc63e4cc90be9f9869947e00db
Instruction Fuzzy Hash: B6D11775A002199FCF14DFA9D8849AEBBF6FF8C350F148569E909A7314EA30DD52CB90

Function 0526DFB8 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09eab5b234ce006936a64ea287caf9e7298743231e2699d41a2a9d1bea016a2d
Instruction ID: 2b76610c972b2b7151ddf12717cae04f5fafebd5f5aa9580028f3a95e006e2f5
Opcode Fuzzy Hash: 09eab5b234ce006936a64ea287caf9e7298743231e2699d41a2a9d1bea016a2d
Instruction Fuzzy Hash: 66A18338B10219CFCB05DF68D894AAEB7B6FF89300B158159E909AF365DB31ED45CB81

Function 05260E20 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fc4a074a0c45164ed0a2f69c2c5e6f4c90234b4182394dbfc4470f9bf4d56e
Instruction ID: bb564fbb758ceff54bf51013a3bc96bb105ba49ca69ef65f57185ee1c19a9e12
Opcode Fuzzy Hash: 11fc4a074a0c45164ed0a2f69c2c5e6f4c90234b4182394dbfc4470f9bf4d56e
Instruction Fuzzy Hash: CF914B75B102159FCB44DF68D885AAE7BF2FF88310B148569E81ADB392DB34EC42DB50

Function 05260848 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d557499795a17fa68c63a5344d28714c2b94370938d13f416f38896de31007ea
Instruction ID: 3e6fbae90f67981d7005f55ae20a98077085e0c9911666d0ab9f723afd75168a
Opcode Fuzzy Hash: d557499795a17fa68c63a5344d28714c2b94370938d13f416f38896de31007ea
Instruction Fuzzy Hash: BD51AF74B102059FDB14DB78D898A6EBBF6EF88310B148429E94AD7345EF30EC42DB91

Function 05269B00 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60fdcf50f6f1404a53a005100556a0b87c8d3a359202dc6ffaebec87b1a12a33
Instruction ID: dd54246b6a838c4065e81c60935e0ca80ecbf2c5c666bd70d37f6286e0430f59
Opcode Fuzzy Hash: 60fdcf50f6f1404a53a005100556a0b87c8d3a359202dc6ffaebec87b1a12a33
Instruction Fuzzy Hash: B04106357102056BC704ABB9A81567EBBE6EFC8750F14842AE909DB381DE35CC45D7A1

Function 0526A518 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3468d29eccb865d85808f3fab9e877cce2017899fd20aa519a99fe8ccd939324
Instruction ID: 8ab08c2015c791f9e1fb8f3848d840bded5d346a2b1be751c052d956d4ef30f2
Opcode Fuzzy Hash: 3468d29eccb865d85808f3fab9e877cce2017899fd20aa519a99fe8ccd939324
Instruction Fuzzy Hash: FD513A75A10215EFCB14DF68C584AADBBB6BF88314F558069D80ABB351DB70EC82CF90

Function 0526F6F8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f8d87cd62698d41e79b1813958b91d20b5a2c6bc550d6aa7bc30849a6cb8e7
Instruction ID: 1e955b4601af44536b8391de87083816d2544a904a59c7ba3a248ea46a1b85d5
Opcode Fuzzy Hash: f0f8d87cd62698d41e79b1813958b91d20b5a2c6bc550d6aa7bc30849a6cb8e7
Instruction Fuzzy Hash: E141A0743003559FCB15DF28D884A9E7BE6EF98311B008929F549CB365DF70EC458B90

Function 0526DFAA Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d341e8de2d17ea67c3bc5441eee8f9d76ad734ec32c1ab4e4e871f00efb4c75
Instruction ID: 5135cb3ee139667030d15a326fe46d5afd9d20a3ce1c7d1d93b565f9a2c3ccfe
Opcode Fuzzy Hash: 2d341e8de2d17ea67c3bc5441eee8f9d76ad734ec32c1ab4e4e871f00efb4c75
Instruction Fuzzy Hash: 1041AD38620219CFCB14DF58C584EAABBF6FF89300B158298E909AF365D731ED85CB41

Function 0526CD10 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9b1d356258175864a3b26e7a71151346dd8e781bca15bd2a60ed400d13bba8
Instruction ID: dc640504c353794f40323f9a8139f5ed79211e5b6ad9ab63e21e9af5a3ee6b56
Opcode Fuzzy Hash: 8b9b1d356258175864a3b26e7a71151346dd8e781bca15bd2a60ed400d13bba8
Instruction Fuzzy Hash: D9416035B102558BCB18AB69D4586AEBBF2AF8C310F554179E445EB390DF35DC81CB90

Function 0526C243 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4198897145f50731e49495bb3edb6aef1a59bffb3409c00cec138185432c0e02
Instruction ID: 5494d24b14c20ff5229a0cae613cb7f1076a9a6122dd00fa2e393fdc6fd83b9e
Opcode Fuzzy Hash: 4198897145f50731e49495bb3edb6aef1a59bffb3409c00cec138185432c0e02
Instruction Fuzzy Hash: 6D31C4313103129FC715EF29D8946AABBE2FF85715B144469E886CB351DF70EC86C790

Function 0526AF37 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13f3e595cd44847d9ca369ff467461fa008a43ca3ba74732b89903d18e70cb7
Instruction ID: 9f5fa1bf05329dc83c70bab12d088d18667d84658fc09cd57115b0c90aa3c1bd
Opcode Fuzzy Hash: e13f3e595cd44847d9ca369ff467461fa008a43ca3ba74732b89903d18e70cb7
Instruction Fuzzy Hash: 6731F4757102118FCB05AB7CD855B6E7BE7EFC9750B150129F40AEB381DF288C0287A2

Function 0526F248 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8a15e82b6a543cfd700923a45f5e567a843d6d621a717e69675ef28b9c4f3e
Instruction ID: d35b9872b12f9bc31de68c4bd29ca5fe615f2c4e520a1ef2df0084a211e76aa8
Opcode Fuzzy Hash: 5d8a15e82b6a543cfd700923a45f5e567a843d6d621a717e69675ef28b9c4f3e
Instruction Fuzzy Hash: 2A3139765142905FC701EB7CE8A1AEA7FF4EF89321F08006AEAD9CB312D525D846C794

Function 0526C288 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ab11d5dc2e86e56f37efb130c4e88e9f5825e885f0180d57216c1b25a12544
Instruction ID: 422a97c57d002191fcaf569d5ee17a441e9061dc573f24b1fdd3861c8ef4e917
Opcode Fuzzy Hash: c7ab11d5dc2e86e56f37efb130c4e88e9f5825e885f0180d57216c1b25a12544
Instruction Fuzzy Hash: E93182353107129FC718EF29D488A2AB7E6FFC86517148929E846D7354DF70EC82CB90

Function 0526C23F Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d0a72d7b52a71b11c119cb2f213369374444a7ff0b69c14228722a64accbd4
Instruction ID: e8576741184425486e3eb13016958f4adb3a3429bbe6c47c273566d0f60a00ce
Opcode Fuzzy Hash: c3d0a72d7b52a71b11c119cb2f213369374444a7ff0b69c14228722a64accbd4
Instruction Fuzzy Hash: F73182353247128FC718EF69D48866AB7E6FF882117148929E887D7354DF70EC82CB50

Function 0526F4B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0612a5de45cc0ae036fd19113ac3f8c79bf361eb37f5a22ff640820f88c889
Instruction ID: f2f626deb8d1064dd76d2034d2abc662723dc73dc288c56a871fb7b33cb9ba94
Opcode Fuzzy Hash: dc0612a5de45cc0ae036fd19113ac3f8c79bf361eb37f5a22ff640820f88c889
Instruction Fuzzy Hash: F8317A75A142098FDB14DFA8D584AEEBBF2EF48310F144065E415AB3A5CB74AD85CBA0

Function 0526C780 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084e8f728f5c3a5ac719132bfb16b79725f288f30c6454677c9a1b016a08a65d
Instruction ID: 44ec77d580726053c38b9cc1d51f8f6f5d11293fc68b54d2f512065014ea317f
Opcode Fuzzy Hash: 084e8f728f5c3a5ac719132bfb16b79725f288f30c6454677c9a1b016a08a65d
Instruction Fuzzy Hash: DB316E746002159FCB04DF69D8849DDBBF6FF89315B248199E809AB366DB35ED02CBA0

Function 05262EF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfe7c5338554d0dbf2f20eff1b7313b50b707ce5596bb99589b34d5ac4e1267
Instruction ID: c80827b18d4fcb78d8266102651c9a0d87efebc7b17a5e091fb39ea9196c8ca3
Opcode Fuzzy Hash: 3bfe7c5338554d0dbf2f20eff1b7313b50b707ce5596bb99589b34d5ac4e1267
Instruction Fuzzy Hash: BD31683471020BCFCB15EB69D948A6E7BA6FF88205B404529E40A9B395EB70ED81CB91

Function 05262EE8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f446fb11b564c7915bc9e41272fb91fed2c2469b8c2f6918f69376601504e8f
Instruction ID: fe4288bb435ef50f5a19c6031f07e4faa443006d031da08ff5b4c5ccb395e1b8
Opcode Fuzzy Hash: 2f446fb11b564c7915bc9e41272fb91fed2c2469b8c2f6918f69376601504e8f
Instruction Fuzzy Hash: 9631EE34714207CFCB05EB68D554A6E7BB2FF84205B40452AF00AEB286EB30DD84CB80

Function 0526C790 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84afad3d5ce46b0bc6452ee326e6e9bf35f9e01323232aa6da35b947a2ea827d
Instruction ID: 252205895c8de60a043c80425308aea740e0898114c3f98170d3ef32f496dee9
Opcode Fuzzy Hash: 84afad3d5ce46b0bc6452ee326e6e9bf35f9e01323232aa6da35b947a2ea827d
Instruction Fuzzy Hash: 38314C746002099FCB04DF69D4848DDBBF6FF89314B208199E909AB325DB35ED02CFA0

Function 05260818 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b49dec15bab13dfd3858e31c9b593137d6fa1d640a9257f7b7762051efff155
Instruction ID: b2eb265bbbd8ec977e6bf6c06c328f5e2c512934aaa61cce1fa7d1889a387593
Opcode Fuzzy Hash: 9b49dec15bab13dfd3858e31c9b593137d6fa1d640a9257f7b7762051efff155
Instruction Fuzzy Hash: 8D219271B153055FCB11DB69C894AAFBBF5EF86610B04805AD809DB341EB30EC45C7A1

Function 0526A298 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea6bc3c29e78d0959900b46eadb8a85d1e8ea38d0047f608b1e4bf09190fbd0
Instruction ID: c003919349d37eef159a1bc1c0ea61d3d249bdc06d2320527320b923d9164907
Opcode Fuzzy Hash: 4ea6bc3c29e78d0959900b46eadb8a85d1e8ea38d0047f608b1e4bf09190fbd0
Instruction Fuzzy Hash: 4D2137703102118FC714EF6DD494A5AB7E6AF9C3147908969E14ECF326EB21E8828B80

Function 0526F2E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ef8090fed33027296b51a8e5125f4b9c5371b1bc20cb7412611d5cad616da5
Instruction ID: 26c32e18d38e4f3fb0ef4368331f1422afbe8e19bb893930e901896003da718e
Opcode Fuzzy Hash: 34ef8090fed33027296b51a8e5125f4b9c5371b1bc20cb7412611d5cad616da5
Instruction Fuzzy Hash: A5216F353006509FD7159B69E498D7ABBE9FF88320714442EF94A87361CA36DC41CB50

Function 0526F5D2 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e839c440a44c8c5b28f5607cb8976fcc4a3bd6514d68f60d8d187b4ad36b4a
Instruction ID: 979efd50799ac4e6cd4ff003331295fa483fb13c78e160401db83ba971d63fd0
Opcode Fuzzy Hash: 28e839c440a44c8c5b28f5607cb8976fcc4a3bd6514d68f60d8d187b4ad36b4a
Instruction Fuzzy Hash: 2E115BB5A002159FCB04DFA8C585ADEFBF5FF88310B15852AE91CE7315DB34A906CBA0

Function 0526F5E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4042edfc717d368677a47187e145b703189a2a565a1e15905b5bca9a68200329
Instruction ID: 2751fcc049b945a0f1b539c76120345847ad7bde2f3dc286c2b83033d521c1fc
Opcode Fuzzy Hash: 4042edfc717d368677a47187e145b703189a2a565a1e15905b5bca9a68200329
Instruction Fuzzy Hash: A0116DB4A002059FCB04EFA8C4819DEFBF5FF88310B11852AE91CE7311DB30A906CBA0

Function 05269AD0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb3d915efaa3ae52d8c41a7497dd27be24b2ea752b92ea4f0561d21f5e0bb50
Instruction ID: 8d2533dbfeba6d3846643b354d19341cefc2cb376a38fa20f5d1a0947faa19f9
Opcode Fuzzy Hash: 8cb3d915efaa3ae52d8c41a7497dd27be24b2ea752b92ea4f0561d21f5e0bb50
Instruction Fuzzy Hash: 2601DF7221C3842FC7024A64AC552DA7F38EFA2160F099096E999DB552DA38888AC761

Function 0526AEB1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2854584099d1fab2196550244ac8fd2eb99bffb87a406064981304e32538a5
Instruction ID: 8ee1ee84d384cc7398b480cfc0fc5ac66ca9dbed0497240e7ba43498c8fb7818
Opcode Fuzzy Hash: 3a2854584099d1fab2196550244ac8fd2eb99bffb87a406064981304e32538a5
Instruction Fuzzy Hash: 1801F771B103119BDB25DB74E84577D77E2FF80612F04593DE405A7680DF35D8868780

Function 0526CC88 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9206714683280154a95aba9b7fa25a2a2b9eba24faf19b3a1d6d234aebe8221d
Instruction ID: ae9fcb40b6dda72b23aba3db57ac6609643d8de424372b1a7b4ff2978e8e771f
Opcode Fuzzy Hash: 9206714683280154a95aba9b7fa25a2a2b9eba24faf19b3a1d6d234aebe8221d
Instruction Fuzzy Hash: 1101F4327003095F8718EB79985456BBBE7FFC92507044439F509D7341DF71AC029798

Function 0526AEC0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22cc6f5ef8f7b103f8fd3cc9e526f96bc31a887790d41523408112deaf1063c
Instruction ID: 467ffe047d815fd3c67b0db02455576eea8e4b122763d8217ea85134a64bf715
Opcode Fuzzy Hash: f22cc6f5ef8f7b103f8fd3cc9e526f96bc31a887790d41523408112deaf1063c
Instruction Fuzzy Hash: 2E01D171B00316ABDB25AA75E84466E7BE7EFC0612B04583DE409AB280DF75E8858BD0

Function 0526FC60 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef155de5345284c092d6af56d2db074a93adbba406e79794af7a5e901bde383
Instruction ID: 0c51b0ea80d315caccd4de716800cbc9eac71084bcd06710a28b74fbb6c374f6
Opcode Fuzzy Hash: bef155de5345284c092d6af56d2db074a93adbba406e79794af7a5e901bde383
Instruction Fuzzy Hash: AA018136200209AFCB05CF54EC89A9E7FB6FBC8321B10852AF94687361CB74DC12DB60

Function 0526CC78 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6774c7562b8fd2ec29fffdcd42921c85b54027f0c1ba5f3c11d6eb4ed1e196a0
Instruction ID: e51c41ce0bb0670fff3f725636f03763620071f72a97ac82f95ceff1828850a7
Opcode Fuzzy Hash: 6774c7562b8fd2ec29fffdcd42921c85b54027f0c1ba5f3c11d6eb4ed1e196a0
Instruction Fuzzy Hash: CCF0F4327083556FC305EB299C5496ABFE6EF89210704402AE549C7652DFB5AC06C794

Function 05262A41 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6915e183405c4cd53798316cdde71a80c7262d415722ae7e7ebc8317f66fa3b
Instruction ID: cb400aef790de35a081217407908c24f70be6660f7641aab0b4e1981e1563246
Opcode Fuzzy Hash: d6915e183405c4cd53798316cdde71a80c7262d415722ae7e7ebc8317f66fa3b
Instruction Fuzzy Hash: 5501B1BD9242AACEDB21DBA4D9087FE7FB1FF45301F058866C001A6195CBBC5D85CB61

Function 05262A50 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1440a529060dc98034196f659913a6b43dafbf4c10e068ce220efe9e641daf8f
Instruction ID: d75f183741d1b76258f318ce19eb81400f1696651c52c067c24ccd534a263b19
Opcode Fuzzy Hash: 1440a529060dc98034196f659913a6b43dafbf4c10e068ce220efe9e641daf8f
Instruction Fuzzy Hash: 43017C7DA1429ADEDF20DBA5D8087AEBBB5BF44301F008426D415A6284DFB81D84CBA1

Function 05263E30 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acfd83ed62a166ff6601981213d9c78006984105f33469711dc074e60459d78
Instruction ID: 6f958dd0551780a85f7c8d445949696c7801c757795b27fd55a80c3bddaa468e
Opcode Fuzzy Hash: 2acfd83ed62a166ff6601981213d9c78006984105f33469711dc074e60459d78
Instruction Fuzzy Hash: E101A270E6830ADFE710EF68D41A76F7FB0AF01704F104859D459A76C2DBB44685CBA2

Function 0526FC70 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31e9e0ede763549ddf003dd3264aa463964231e7ddb330066665c8fbe574971
Instruction ID: 31f98d86de76f77438c03a9ae74d499f68d3d1ef7cc92509c219b88c295adc84
Opcode Fuzzy Hash: a31e9e0ede763549ddf003dd3264aa463964231e7ddb330066665c8fbe574971
Instruction Fuzzy Hash: EFF0F935200258AFCB15DF69E889C9A7FAAFBC8721B00842AF94687361CE70DC51DB60

Function 052695DF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644fd7279621fad4552ab0e7980fe026ba44627e9ef392a824fb43fb369f88be
Instruction ID: c8d091480fc278b8c50dd433b05d2dfc1f49141d545777befa7fada8c128d99a
Opcode Fuzzy Hash: 644fd7279621fad4552ab0e7980fe026ba44627e9ef392a824fb43fb369f88be
Instruction Fuzzy Hash: DEF0E93242434D9FC300BB78D84599DBFB8FF51304F498267D0899A513EE34A49ACB92

Function 0526CD00 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a6c60240384675e8c61dddc581e6f19e2a535075131a9ba26187230a413bec
Instruction ID: 54cb65fa7f389f41c6b6c7b73aa6641cc72ad9e51e389bcd823eefe6c128fec7
Opcode Fuzzy Hash: b2a6c60240384675e8c61dddc581e6f19e2a535075131a9ba26187230a413bec
Instruction Fuzzy Hash: 50E061337087610B871556273C998B7EF9A5DC5169309817BF44CD7151DD38CC428270

Function 0526A481 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99acbae290415efd34ecb4432c987515cdbd1f4ddcfd2d76839f93ed367be11d
Instruction ID: c024a091aac28875deb7fa86d3da504e2b0c32e83abbb745a0b939dfb8964232
Opcode Fuzzy Hash: 99acbae290415efd34ecb4432c987515cdbd1f4ddcfd2d76839f93ed367be11d
Instruction Fuzzy Hash: 77F0ED70E0420CEFCB44EFA8D44569CBBB6EF84300F4086A9E449B7750DA391A498B45

Function 0526A438 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3606315cffdbf95dc596262ef65be7400cc21bafe59f7db996f9bef57903c4a4
Instruction ID: 53cf430944d1afb595b6ef37821a681767822d96e65722b0b3a5ff98a162b9c8
Opcode Fuzzy Hash: 3606315cffdbf95dc596262ef65be7400cc21bafe59f7db996f9bef57903c4a4
Instruction Fuzzy Hash: 07E01A71320210CBC7148B28D849A9577A6EF8D224B558859A4468B751CB79DC438B80

Function 0526A370 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e10f87c9cc1ba64ce31ea598a2b6e1a71a3423fc2d85c365ab79f37d35936dc
Instruction ID: 6d1a48df0bb5aa24a560d440e52c5c11fa133d4004ca4306f1d86d047879d9f4
Opcode Fuzzy Hash: 8e10f87c9cc1ba64ce31ea598a2b6e1a71a3423fc2d85c365ab79f37d35936dc
Instruction Fuzzy Hash: E3E0E5B5E0520CAFCB44EFA9E44569DBFF5EB58340F0081AAD808E3300EA389A428B44

Function 052629F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae93050329f9b4d288bf17c9190573eb178dbd1fba80eaa82e0b3d41ced69f3
Instruction ID: 3220b36eedb7018de30d2c0204588b977df2fd0ef7eee1ede026ae8fe3e82271
Opcode Fuzzy Hash: 2ae93050329f9b4d288bf17c9190573eb178dbd1fba80eaa82e0b3d41ced69f3
Instruction Fuzzy Hash: 93E08C39324214FBC3246BB0F80E1893F68EF46236345906AF407CA681CF7DCC818BA2

Function 05269A81 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7a4cbc76a2c4e3e72619eef1467e3b13feae41713051c4e6cb6f8fbf43a0e7
Instruction ID: 169dc4de72844388e11b00872077ef207e75e74f60033ac76e5b8a9ab4ccba38
Opcode Fuzzy Hash: 1e7a4cbc76a2c4e3e72619eef1467e3b13feae41713051c4e6cb6f8fbf43a0e7
Instruction Fuzzy Hash: 53E09A712007608FC714DBA8C9489AA7FE4DF8430AB04899AF04BCB3A2DA74EC408B40

Function 05269A48 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69eb9b4375c21f575616a604c28964a8cb838b6c8853ce2e72dd40788ff4d04
Instruction ID: faac35d20e05774414be62c25fc03c41a28bbb14b99a0c7edd2b27836536f589
Opcode Fuzzy Hash: f69eb9b4375c21f575616a604c28964a8cb838b6c8853ce2e72dd40788ff4d04
Instruction Fuzzy Hash: A7E02B312106208FC7005A28E4847C977DCEF4C331F204196F506CB731DA68DC828BC0

Function 0526A490 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f9e09687cb602f7b82a0ad75becb781156c6ad2d9e93c0428e53b40d1d10b7
Instruction ID: 3755381ec1f32f5f80cbca4c35ed47caa85256aba750426bdfe9ba4ce1f87e9a
Opcode Fuzzy Hash: a8f9e09687cb602f7b82a0ad75becb781156c6ad2d9e93c0428e53b40d1d10b7
Instruction Fuzzy Hash: 4BE01270E0420CAFCB48EFA8E44149CBBF5EB84300F0089A9E809A7350EA342A098F85

Function 05262A08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303b04aff9f6a28849775fbd0d87500c9b26b03b01f5942f835ef6632b1ebfae
Instruction ID: 099d27e0c9773a4d0082285d3e1f6c5ed1cec0439e14aef88c3bd022707c52fb
Opcode Fuzzy Hash: 303b04aff9f6a28849775fbd0d87500c9b26b03b01f5942f835ef6632b1ebfae
Instruction Fuzzy Hash: BBD0173A324214EB8734ABB4B40D0993F6CEE45276304506AF40AC6680CF7A8C80CB91

Function 0526A380 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db503c7c772453472d2cc76cf6e917c5b4b620d846492ef20e63ecb090faebe8
Instruction ID: ab71b2d1a5d8a35fa04b14f95f7925c3521aad5d6fdd55bc32bedc8588151088
Opcode Fuzzy Hash: db503c7c772453472d2cc76cf6e917c5b4b620d846492ef20e63ecb090faebe8
Instruction Fuzzy Hash: 72E00274E05208AFCB44EFA9E54559DFFF5AB88300F1081AAD819E3351EA349A55CF85

Function 05262910 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab91581342086156c2017937c4420893407df83873d1906c128f1308a80b16c4
Instruction ID: 099c74a95e822343a082a5f8bc86394093aae796e64b151c6a70bbfedf54c7bc
Opcode Fuzzy Hash: ab91581342086156c2017937c4420893407df83873d1906c128f1308a80b16c4
Instruction Fuzzy Hash: 48D0A73A222105EBDB322A20F94A3E53F68FF95311F94D011E08ACD581DE48C4434291

Function 05269610 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bec2fee2a46fe080f782989b58dfeccf336c32e064a334ed660db071acba755
Instruction ID: 8d3eeb47966f610bd83eeff7eb6891f2b62cd1b6b28d3555f9edc5702f71989c
Opcode Fuzzy Hash: 2bec2fee2a46fe080f782989b58dfeccf336c32e064a334ed660db071acba755
Instruction Fuzzy Hash: 60D0A73145430C9FC300BB68D88179C7F74FF54314F449225E4496A501EE64E49BC781

Function 0526A3B9 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa24d2c5dded6c838b0adfc2e0c23b621cdf59ca0d695185fd196d723345a2b6
Instruction ID: 0d63b7a3608778bce409242b7b124817df348866fa9ced402577566adbf4a5f5
Opcode Fuzzy Hash: aa24d2c5dded6c838b0adfc2e0c23b621cdf59ca0d695185fd196d723345a2b6
Instruction Fuzzy Hash: FBD0A77290420967C724DE9EC8013DE73AFDBA1240F4006A59809D7200EE719B1587D7

Function 052695B1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037f9e95e30b4e155dac7278d30f61a87e9bef81262bba6df9f0c8f3dcecf387
Instruction ID: 4ed85ef4c576e43fcf22b0b195e8d9a1e5f6ad7ab0c3371922e4b874de8d35a2
Opcode Fuzzy Hash: 037f9e95e30b4e155dac7278d30f61a87e9bef81262bba6df9f0c8f3dcecf387
Instruction Fuzzy Hash: 0AD0A73245030C9FCB14FB64D8816DCB778FB50314F415229D48667510EF28A9AFCB92

Function 05269A58 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d287a556caed266d697d8821a25d9db9a07922307c9c2a3f459ecc8bd4a9e9a0
Instruction ID: 28a94561226a536b5209cd8f6cb714c7805bb98c26bcdc59cc2f47353da816d2
Opcode Fuzzy Hash: d287a556caed266d697d8821a25d9db9a07922307c9c2a3f459ecc8bd4a9e9a0
Instruction Fuzzy Hash: 2FD0C931221A248FC705AB6CF4488997BEDEF4962631045AAF61ACB375DEA5AC448BC4

Function 0526A3C8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7460736f33c84b167676449f6748579e90b7a25170c1958f0fb3ebe7e4243853
Instruction ID: 6d16b4098b8784fc01620ad5285cfe82a32ee6c39d87a960c88692e2d344b28d
Opcode Fuzzy Hash: 7460736f33c84b167676449f6748579e90b7a25170c1958f0fb3ebe7e4243853
Instruction Fuzzy Hash: EEC08C71A0430DAB8B14EEEA88004AEB7EEDB82100B0047AA9C0EC3200EE715F1046E7

Function 05262920 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0cf8fe6b0f10b89393fb07904d72ad0d0c28e1d717cfcefb988e8a719b0c6b
Instruction ID: 58d0b1c91c96c201809f13f16746d1732c4c65fce0e53089cc0280cb3b22056a
Opcode Fuzzy Hash: ee0cf8fe6b0f10b89393fb07904d72ad0d0c28e1d717cfcefb988e8a719b0c6b
Instruction Fuzzy Hash: FEC08C343259089BDB201BA07A0D3263B4CEF80205B804060F40ECD080DE6488008511

Function 052695F0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc36eef8aede059289b0b568df65351570d55a484c8705144f33b54ccfa96ec
Instruction ID: b4cc289d5a5ecec8fee7b80a7c8ffdee454f26fab32a28b91106ba17cebe3c61
Opcode Fuzzy Hash: 2fc36eef8aede059289b0b568df65351570d55a484c8705144f33b54ccfa96ec
Instruction Fuzzy Hash: F4C0123241070D8EC700BBA8E884898BFB8AB15300B00822AE4452A211EF30A1A9DF92

Function 052695C0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9232ef2f4a96cba94a7406212d898b3a02780def3e6863741a3a25fada7c37ed
Instruction ID: 5d07585b552f594a8c0331239c96d092ff6f62ce45c905d30fdde37425684982
Opcode Fuzzy Hash: 9232ef2f4a96cba94a7406212d898b3a02780def3e6863741a3a25fada7c37ed
Instruction Fuzzy Hash: 8DC0123141070C8EC740BB68D4448987B78AB15201B405119D4451A110EF20A5D9DB91

Function 05269620 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899233841.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5260000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366736735fdb8115c9f9f4d1f08f265fa2164d01878d4cf323c6a0ad0503cba4
Instruction ID: 4d2c1acb5fd402ecf758e8c4e2250d29883ae8eb60f6b834190c63321b880297
Opcode Fuzzy Hash: 366736735fdb8115c9f9f4d1f08f265fa2164d01878d4cf323c6a0ad0503cba4
Instruction Fuzzy Hash: FCC0123141070CCEC700BBA8E844899BFB8BB15301F00822AE4496A110FF20A1A9DB91

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: setup.exePID: 6868, Parent PID: 2580

Windows Analysis Report
setup.exe

Function 010715F0 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 010715F8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 0526A0B8 Relevance: 1.4, Strings: 1, Instructions: 170
COMMON

Function 0526A0AA Relevance: 1.3, Strings: 1, Instructions: 81
COMMON