Edit tour

Windows Analysis Report
RFQ SY103 2nd order 2024.exe

Overview

General Information

Sample name:	RFQ SY103 2nd order 2024.exe
Analysis ID:	1466686
MD5:	52a63eb1af96bcccba7e8faf1280ecd1
SHA1:	618eeb2a27bbd791a1546285a77fac4b252aa06a
SHA256:	215f60a1a446cc7dedc8bea601806fab901769340cff8d02a991d8ca9bf0782b
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

RFQ SY103 2nd order 2024.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe" MD5: 52A63EB1AF96BCCCBA7E8FAF1280ECD1)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AddInProcess32.exe (PID: 7380 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

jsc.exe (PID: 7404 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

jsc.exe (PID: 7412 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

WerFault.exe (PID: 7492 cmdline: C:\Windows\system32\WerFault.exe -u -p 7296 -s 1032 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["178.23.190.118:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.1725634665.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1764969860.00000209637C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: jsc.exe PID: 7404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 7404	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.RFQ SY103 2nd order 2024.exe.209638b2d70.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.jsc.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ SY103 2nd order 2024.exe.209638b2d70.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 178.23.190.118 - Destination IP: 192.168.2.4

Timestamp:	07/03/24-09:26:54.237167
SID:	2043234
Source Port:	1912
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 178.23.190.118

Timestamp:	07/03/24-09:26:54.055105
SID:	2046045
Source Port:	49730
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 178.23.190.118 - Destination IP: 192.168.2.4

Timestamp:	07/03/24-09:26:59.486185
SID:	2046056
Source Port:	1912
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 178.23.190.118

Timestamp:	07/03/24-09:27:01.472345
SID:	2043231
Source Port:	49730
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["178.23.190.118:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: RFQ SY103 2nd order 2024.exe	ReversingLabs: Detection: 23%
Source: RFQ SY103 2nd order 2024.exe	Virustotal: Detection: 27%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296, type: MEMORYSTR

Source: RFQ SY103 2nd order 2024.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdbx source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER1F3C.tmp.dmp.7.dr

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 178.23.190.118:1912
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 178.23.190.118:1912
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 178.23.190.118:1912 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 178.23.190.118:1912 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 178.23.190.118:1912

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 178.23.190.118:1912

Source: Joe Sandbox View

ASN Name: LYNERO-ASDK LYNERO-ASDK

Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118
Source: unknown	TCP traffic detected without corresponding DNS query: 178.23.190.118

Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp, RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.00000209637C8000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1725634665.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ SY103 2nd order 2024.exe

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A43EC	0_2_00007FFD9B8A43EC
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8AC281	0_2_00007FFD9B8AC281
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A1800	0_2_00007FFD9B8A1800
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8B4759	0_2_00007FFD9B8B4759
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8ABDF9	0_2_00007FFD9B8ABDF9
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8AEE09	0_2_00007FFD9B8AEE09
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A94E0	0_2_00007FFD9B8A94E0
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A94D8	0_2_00007FFD9B8A94D8
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8B07AA	0_2_00007FFD9B8B07AA
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A14F8	0_2_00007FFD9B8A14F8
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B980050	0_2_00007FFD9B980050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_0112DC74	3_2_0112DC74

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7296 -s 1032

Source: RFQ SY103 2nd order 2024.exe

Static PE information: No import functions for PE file found

Source: RFQ SY103 2nd order 2024.exe, 00000000.00000000.1617300258.0000020951902000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOjanohawupelabo2 vs RFQ SY103 2nd order 2024.exe
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.00000209638F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs RFQ SY103 2nd order 2024.exe
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.00000209638F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEkisahagowazi6 vs RFQ SY103 2nd order 2024.exe
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEkisahagowazi6 vs RFQ SY103 2nd order 2024.exe
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs RFQ SY103 2nd order 2024.exe
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1762706745.0000020953430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEkisahagowazi6 vs RFQ SY103 2nd order 2024.exe
Source: RFQ SY103 2nd order 2024.exe	Binary or memory string: OriginalFilenameOjanohawupelabo2 vs RFQ SY103 2nd order 2024.exe

Source: RFQ SY103 2nd order 2024.exe, ----------------.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@9/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7296
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7304:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\510e5758-a5a4-45d0-ab9c-1d0bbb74bb04

Jump to behavior

Source: RFQ SY103 2nd order 2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ SY103 2nd order 2024.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ SY103 2nd order 2024.exe	ReversingLabs: Detection: 23%
Source: RFQ SY103 2nd order 2024.exe	Virustotal: Detection: 27%

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

File read: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe "C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe"
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7296 -s 1032
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RFQ SY103 2nd order 2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ SY103 2nd order 2024.exe

Static file information: File size 2714665 > 1048576

Source: RFQ SY103 2nd order 2024.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ SY103 2nd order 2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdbx source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER1F3C.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER1F3C.tmp.dmp.7.dr

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A59E2 push esi; retn 0008h	0_2_00007FFD9B8A59E3
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A81A2 push ebx; ret	0_2_00007FFD9B8A816A
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A8123 push ebx; ret	0_2_00007FFD9B8A816A
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B8A58DA pushad ; ret	0_2_00007FFD9B8A58DB
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Code function: 0_2_00007FFD9B980050 push esp; retf 4810h	0_2_00007FFD9B980312

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory allocated: 20951C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory allocated: 2096B520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 1120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 817			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 2039			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7728	Thread sleep time: -11068046444225724s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7440	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: jsc.exe, 00000003.00000002.1731043654.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: RFQ SY103 2nd order 2024.exe, ----------------.cs	Reference to suspicious API methods: GetProcAddress(_EE0C_EC70_EE8C_0E65_0E6F_EC86_EE7C_0EA6_EC96, _08FD_EE61_EE25_0E69_EE01_EE4D_0657_EC96_EE5C_EEEF_EE97_EEC1_0E83_EE64)
Source: RFQ SY103 2nd order 2024.exe, ----------------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_EE63_EC84_EEE9_EED3_EE86_EE77_0604_EE1B.Length, 64u, out var _08FB_EE71_08D9_0607_EE52_EEDA_0EB4_0607_EE10_08DA_EC80_EEAA_EE7B_08FB)
Source: RFQ SY103 2nd order 2024.exe, ----------------.cs	Reference to suspicious API methods: LoadLibrary(_061F_EEB9_EE43_EE61_08FE_08C8_EEA0_EC93_08EE(_EC92_EE85_08DA_EE70_EEDF_0E66_0653_EE6A_EEF1_EEF3_EEEB_EE8B_EE4D_EC89_0E80_EE13_EEDE_0E7F_EC84._EECA_ECB9_EEB3_EE0C_EE58_EED9))

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: B22008	Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe	Queries volume information: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209638b2d70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209638b2d70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1725634665.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764969860.00000209637C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7404, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: jsc.exe, 00000003.00000002.1727587721.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: jsc.exe, 00000003.00000002.1731043654.0000000005FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^qp
Source: jsc.exe, 00000003.00000002.1731043654.0000000005FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q%appdata%`,^qdC:\Users\user\AppData\Roaming`,^qdC:\Users\user\AppData\Roaming\Binance
Source: jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^q
Source: jsc.exe, 00000003.00000002.1731043654.0000000005FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.00000209638F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SQLCOLUMNENCRYPTIONKEYSTOREPROVIDERAFBF7A19

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7404, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209638b2d70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209638b2d70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ SY103 2nd order 2024.exe.209639a63a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1725634665.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764969860.00000209637C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ SY103 2nd order 2024.exe PID: 7296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ SY103 2nd order 2024.exe	24%	ReversingLabs	Win64.Trojan.Generic
RFQ SY103 2nd order 2024.exe	27%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Virustotal		Browse
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Virustotal		Browse
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Virustotal		Browse
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	3%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Virustotal		Browse
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Virustotal		Browse
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Virustotal		Browse
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp, RFQ SY103 2nd order 2024.exe, 00000000.00000002.1764969860.00000209637C8000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1725634665.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	jsc.exe, 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/D	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	jsc.exe, 00000003.00000002.1727587721.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	jsc.exe, 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.23.190.118	unknown	unknown		196724	LYNERO-ASDK	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466686
Start date and time:	2024-07-03 09:26:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ SY103 2nd order 2024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@9/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 35 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:26:58	API Interceptor	16x Sleep call for process: jsc.exe modified
03:27:04	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LYNERO-ASDK	Document-1975072354.xls	Get hash	malicious	Hidden Macro 4.0	Browse	178.23.190.8
	Document-1975072354.xls	Get hash	malicious	Hidden Macro 4.0	Browse	178.23.190.8
	https://carolinadoggieplayland.getform.com/d1428	Get hash	malicious	HTMLPhisher	Browse	178.23.190.117
	AA1878F26132481B357627A0EF684FF68763E6E315FCE.exe	Get hash	malicious	RedLine	Browse	178.23.190.74
	TWdjAGnYuQ.exe	Get hash	malicious	RedLine	Browse	178.23.190.183
	usfive_20220219-134311.exe	Get hash	malicious	Lu0Bot	Browse	178.23.190.155
	FortMod 6.3.exe	Get hash	malicious	RedLine	Browse	178.23.190.213
	jb0yJdcE3t.exe	Get hash	malicious	Raccoon	Browse	178.23.190.57
	FortMod 7.1.exe	Get hash	malicious	RedLine	Browse	178.23.190.213
	cB2vzM1OZc.exe	Get hash	malicious	Raccoon	Browse	178.23.190.57

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RFQ SY103 2nd or_7be5a683b7ce35d984490767b86aac2a29b92f_5fa42fed_c184db70-752d-49d4-972d-f3d88664d989\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0541588162792324
Encrypted:	false
SSDEEP:	192:Kg9te/sUkv50UnUFaWBey+X2zuiFzZ24lO85Ac3A:Jfe/sU7UnUFamkX2zuiFzY4lO8ec
MD5:	50643312DAC4C07ACB694D50DB2BE227
SHA1:	61561F69DE468A0C07348B2649991B42E61457B3
SHA-256:	E8D30A0ED309D51A6D23C04FEE43ACED916B118747BD72F85C885CB7A7A0B868
SHA-512:	26EE09AC4CB688D7490ADE6D0BE34A8C2636B5E5D5797ECC549E5F866E7080D6BCE56BF5733041F4D4A9E99DC09917A75B853AE554114C994DDAE034A777EE9D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.4.6.5.2.1.1.5.6.2.6.5.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.4.6.5.2.1.2.2.9.7.0.3.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.8.4.d.b.7.0.-.7.5.2.d.-.4.9.d.4.-.9.7.2.d.-.f.3.d.8.8.6.6.4.d.9.8.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.8.5.8.8.b.c.-.1.d.7.9.-.4.2.8.0.-.b.9.6.8.-.f.1.2.0.f.8.c.7.6.f.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.R.F.Q. .S.Y.1.0.3. .2.n.d. .o.r.d.e.r. .2.0.2.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.O.j.a.n.o.h.a.w.u.p.e.l.a.b.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.8.0.-.0.0.0.1.-.0.0.1.4.-.1.6.a.1.-.6.b.5.e.1.a.c.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.e.7.d.0.b.a.7.a.a.6.7.8.f.f.8.a.b.3.3.9.9.c.5.0.c.2.7.9.6.a.8.0.0.0.0.0.0.0.0.!.0.0.0.0.6.1.8.e.e.b.2.a.2.7.b.b.d.7.9.1.a.1.5.4.6.2.8.5.a.7.7.f.a.c.4.b.2.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F3C.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Jul 3 07:26:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	421539
Entropy (8bit):	3.408238233878601
Encrypted:	false
SSDEEP:	3072:XvNDCcrE0+clWioCFTyFX4qt4T4AbzzcSi8V1CCqeiFz3+vt2Vv:/NDCcrExmoCFTyFlIFbzHpq73QUV
MD5:	DBE76B3C302A867AFB7870315D58A14B
SHA1:	DBE062804B3B5BB09573536A978DF837F8117F3D
SHA-256:	737937BA2476B5A82C2215CD4769C4E235DFB2DB62B0A887D625C0903513F137
SHA-512:	A6EEA3D62DAED55F2FD6D2C6A20A511F83CDC4C08B74387D3CCC0339CBE1B624B831F4AE4FDB4BF1D5767DAD77784AD67C5E40B30338E1C854B827796509C9AE
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......;..f....................................$........................I..\|v..........l.......8...........T............(...E...........8...........:..............................................................................eJ......d;......Lw......................T...........9..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8662
Entropy (8bit):	3.7134511079202617
Encrypted:	false
SSDEEP:	192:R6l7wVeJESra46Y9GZMgmfvG6JSypr089bWUhfKym:R6lXJ5Z6Y8ZMgmfuiSmWqf2
MD5:	A8182C3812BD6B6D26731B516E9FC78E
SHA1:	1AB38EA62977339EC9534810E4CF8BC6FEABCB88
SHA-256:	F7A5449D60E3B0C4D8646E7B2EFDE5139ACFD0C376D807B551A34CEEEDA0733D
SHA-512:	DD3637C24845A2161BCACE8CBC3E894494945A08F9CA9604D2A8802F94A35EEF30A36729439054AC548948E6397E11F846EC79C2416CACBB00F87D8880F322AF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2103.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4837
Entropy (8bit):	4.5281267093194
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYiJg771I9VCWpW8VYjcRYm8M4JDavEAFEyq85PNttcB08p0id:uIjfNI7KD7VqfJDavUwNTcB080id
MD5:	F97A5CC93DD76AFABD9FFE673548C9CD
SHA1:	4BC37368FAF4FA1139D50DADBFC7D1FB827CC376
SHA-256:	443B3D7CD607C49E5120FC7CD310A5248B221263AA008B1275741BDA98A14AAF
SHA-512:	73006237256F4AF38354BCA0EA7252514B3F8C6AEDE2064B9E67648061CC3BC0A267103D5AC9087F6D489FA3257845B37F56A3824054BD9B75DE54F2A58D299F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="394469" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46613402744351
Encrypted:	false
SSDEEP:	6144:bIXfpi67eLPU9skLmb0b4WWSPKaJG8nAgejZMMhA2gX4WABl0uNzdwBCswSb+:8XD94WWlLZMM6YFHh++
MD5:	BF3A2B3C272F4E1BD47FEA911743BE2B
SHA1:	2CED844E99D1CFFF45432695F85406D7FB1A86BA
SHA-256:	30FF72B67884CE1B0B00E9C92964FC2ADF39668638C9309A860F30205B5C5E20
SHA-512:	AAADC11EB934B74F522BAD5275472D3ECA115D1A4970880602BFF8F05283DB07D5EFBBBFB6EEAE4ECDA66CCEED49D5AAF1D2B62B27DABF2F124573AFF3BD824A
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.f_................................................................................................................................................................................................................................................................................................................................................n.pk........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.827435220157483
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	RFQ SY103 2nd order 2024.exe
File size:	2'714'665 bytes
MD5:	52a63eb1af96bcccba7e8faf1280ecd1
SHA1:	618eeb2a27bbd791a1546285a77fac4b252aa06a
SHA256:	215f60a1a446cc7dedc8bea601806fab901769340cff8d02a991d8ca9bf0782b
SHA512:	9a4ded726e1243acd98b39e51cfe7d3a924e26fbf373375b6a52b168c0859b9917fa8910ff52bbd654dafccd8b90a186c935ca3dc870bb7da0482f8088e01bd2
SSDEEP:	12288:SaXAJWnx2uDQxVxdXjXX1yeCla5mPxL4vRGjuAGOeAo7h4wIL:XAJyPDcvzXX1yeqhIvTAXL
TLSH:	CCC51281BA874D87FD2A517AE4F131F452FCACA730F2869FDF941C52A02A67C6485272
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....X.f.........."...0.................. ....@...... ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66845801 [Tue Jul 2 19:41:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0xa2c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9f48	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7fe2	0x8000	00f2d9f20c40c9d723dfded7cc885844	False	0.629486083984375	data	6.456896207311338	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0xa2c	0xc00	a3fad74c3dbaa312ce806326b2385845	False	0.2672526041666667	data	4.441629244072946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0b8	0x3c4	data			0.49066390041493774
RT_VERSION	0xa47c	0x3c4	data	English	United States	0.491701244813278
RT_MANIFEST	0xa840	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-09:26:54.237167	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1912	49730	178.23.190.118	192.168.2.4
07/03/24-09:26:54.055105	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	1912	192.168.2.4	178.23.190.118
07/03/24-09:26:59.486185	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	1912	49730	178.23.190.118	192.168.2.4
07/03/24-09:27:01.472345	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	1912	192.168.2.4	178.23.190.118

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:26:53.406356096 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:53.411222935 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:53.411286116 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:53.419182062 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:53.423953056 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:54.024851084 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:54.055104971 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:54.059932947 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:54.237166882 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:54.281636953 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:59.308906078 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:59.313796043 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:59.486185074 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:59.486207962 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:59.486219883 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:59.486229897 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:59.486242056 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:26:59.486255884 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:59.486277103 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:26:59.531632900 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.617952108 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.622948885 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.622993946 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623008013 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623059988 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623063087 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623091936 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623117924 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623120070 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623146057 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623173952 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623276949 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623318911 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623330116 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623347044 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623368979 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623378992 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623393059 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623423100 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.623461962 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.623506069 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628199100 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628227949 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628254890 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628276110 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628293037 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628307104 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628312111 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628353119 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628355980 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628388882 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628422976 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628433943 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628623009 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628674030 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628714085 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628761053 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628765106 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628809929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628823996 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628866911 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628885031 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.628937960 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.628988981 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.629019976 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.629041910 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.629064083 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.633678913 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.633738041 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.633800030 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.633852005 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.633908033 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.633971930 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.634181976 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634241104 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.634572029 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634601116 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634629011 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634644985 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.634658098 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634710073 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634736061 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634782076 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634809017 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634835958 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634946108 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.634974003 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.635024071 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.635052919 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.635102987 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.635129929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.635160923 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.635188103 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.637649059 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.638727903 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.638756990 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.638776064 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.638808012 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.638829947 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.638856888 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.638876915 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.638905048 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.638932943 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.638947964 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.638974905 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.638978958 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639005899 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639024019 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.639031887 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639050007 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.639076948 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.639082909 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639108896 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639134884 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.639134884 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639157057 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.639163017 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639205933 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639231920 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639280081 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639307022 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639334917 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639377117 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639429092 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639456034 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639482021 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639508009 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639538050 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639647007 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639728069 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.639755011 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640016079 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640064955 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640091896 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640185118 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640213013 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640260935 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640288115 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640336037 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640362024 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640388966 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.640922070 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.642642975 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642673969 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642693043 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.642745018 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642771959 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642819881 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642849922 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642877102 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642904043 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642952919 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.642980099 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643007040 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643033981 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643084049 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643110991 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643137932 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643165112 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643192053 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643240929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643268108 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643295050 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643321037 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643349886 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643398046 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643424988 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643451929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643477917 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643543959 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643744946 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643771887 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643799067 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643827915 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.643852949 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644402027 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644570112 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644598007 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644625902 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644675016 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644701958 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644748926 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644776106 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644828081 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644855022 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644903898 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644931078 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644958973 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.644984961 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645032883 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645060062 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645087004 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645112991 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645159960 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645186901 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645215988 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.645242929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646064997 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646092892 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646141052 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646167994 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646272898 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646331072 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646380901 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646446943 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646568060 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646694899 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646743059 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646770000 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646832943 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646882057 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646929026 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646955013 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.646986008 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647036076 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647062063 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647089005 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647115946 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647142887 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647169113 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647196054 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647222996 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647248983 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647275925 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647362947 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647391081 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647438049 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647465944 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647492886 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647541046 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647567987 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647594929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647622108 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647670984 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647699118 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647725105 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647752047 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647778988 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647805929 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647833109 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647881985 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647912025 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647938013 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647964954 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.647989988 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.648017883 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.648045063 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.648071051 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.648097992 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.648293972 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.649712086 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.649768114 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.654939890 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.654968023 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.654994965 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655020952 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655071974 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655098915 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655126095 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655153036 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655157089 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.655201912 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655215979 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.655232906 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655260086 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655286074 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655333996 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655360937 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655388117 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655414104 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655462980 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655489922 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655517101 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655541897 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655591965 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655620098 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655647039 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655694962 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655723095 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655750036 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655776978 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655802965 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655829906 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655857086 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655883074 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655909061 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655958891 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.655987024 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656013966 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656040907 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656068087 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656095028 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656121969 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656147957 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656174898 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656202078 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656228065 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656254053 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656280041 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656306028 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656332970 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656358957 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656385899 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656410933 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656438112 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656464100 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.656522989 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661458969 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661487103 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661513090 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661561012 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661587954 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661614895 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661642075 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661657095 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.661693096 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661716938 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.661720991 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661747932 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661776066 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661823034 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661853075 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661880016 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661906958 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661933899 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.661961079 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662010908 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662036896 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662065029 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662091970 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662118912 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662143946 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662169933 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662224054 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662251949 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662278891 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662306070 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.662332058 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.687876940 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.692904949 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.693152905 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.693209887 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.693209887 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.693259954 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.698272943 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698324919 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698353052 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698380947 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698407888 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698514938 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698542118 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698589087 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698617935 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698666096 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698693037 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698743105 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698769093 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698795080 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.698821068 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.710812092 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.711013079 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.711102009 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.711102009 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.711152077 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.716073990 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.734761000 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.740098000 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.740227938 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.745136023 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745263100 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745290041 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745342970 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745369911 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745397091 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745424032 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745450974 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745476961 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745527029 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745554924 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745580912 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745606899 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745635986 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.745662928 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:00.766011000 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:00.771074057 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:01.464647055 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:01.472345114 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:01.477241039 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:01.645505905 CEST	1912	49730	178.23.190.118	192.168.2.4
Jul 3, 2024 09:27:01.687885046 CEST	49730	1912	192.168.2.4	178.23.190.118
Jul 3, 2024 09:27:01.743005037 CEST	49730	1912	192.168.2.4	178.23.190.118

Target ID:	0
Start time:	03:26:49
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RFQ SY103 2nd order 2024.exe"
Imagebase:	0x20951900000
File size:	2'714'665 bytes
MD5 hash:	52A63EB1AF96BCCCBA7E8FAF1280ECD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1763001067.00000209538BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1764969860.000002096394A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1764969860.00000209637C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:26:49
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:26:50
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:26:51
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x9d0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1725634665.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1727587721.0000000002E66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1727587721.0000000002F04000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:26:51
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:26:51
Start date:	03/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7296 -s 1032
Imagebase:	0x7ff783f00000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B8AEE09 Relevance: 6.7, Strings: 4, Instructions: 1666COMMON

Download Yara Rule

Strings

NL_H, xrefs: 00007FFD9B8AEF93
BL_H, xrefs: 00007FFD9B8AFA62
x6Rc, xrefs: 00007FFD9B8AFAC9
x6Rc, xrefs: 00007FFD9B8AFBD9

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID: BL_H$NL_H$x6Rc$x6Rc
API String ID: 0-2343561832
Opcode ID: cde09c382c7f8c2c3f0812a74e5b820c2879ea5b066ce2673400caef49e7c85b
Instruction ID: 68a5e25a1f7ec2d1814b61d9a123d287f08030ce31f2441fa29822213e66d4ca
Opcode Fuzzy Hash: cde09c382c7f8c2c3f0812a74e5b820c2879ea5b066ce2673400caef49e7c85b
Instruction Fuzzy Hash: 0DB2893070DB494FE369DB28C4A14B5B7E1FF99301B0445BEE48AC72A6DE38E946C781

Function 00007FFD9B8A94E0 Relevance: 6.7, Strings: 4, Instructions: 1654COMMON

Download Yara Rule

Strings

$Rc, xrefs: 00007FFD9B8B134C
x6Rc, xrefs: 00007FFD9B8B108B
x6Rc, xrefs: 00007FFD9B8B10B0
-L_L, xrefs: 00007FFD9B8B0F63

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID: $Rc$-L_L$x6Rc$x6Rc
API String ID: 0-2066889307
Opcode ID: 2762b062a571fdd3913356072d2c85cae6a5cdccf6a18032087916ee3c91d691
Instruction ID: b44a01aba64bfb473713da1fc63ab9de19f03d7e31f5051f00aad93a4cb40b6e
Opcode Fuzzy Hash: 2762b062a571fdd3913356072d2c85cae6a5cdccf6a18032087916ee3c91d691
Instruction Fuzzy Hash: 33C2E931B19A5D8FDBA8EB68D465A7877E1FF59300F1500B9D04ECB2A2DE34AD41CB81

Function 00007FFD9B8B07AA Relevance: 2.4, Strings: 1, Instructions: 1107COMMON

Download Yara Rule

Strings

-L_L, xrefs: 00007FFD9B8B0F63

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID: -L_L
API String ID: 0-1221955707
Opcode ID: 32262c2494f33215c175c432897ca5d6022cad93eefe2bdf93c05b431b17c7a5
Instruction ID: 7fad412ab370747287846739f178c16a4960f8cf0eb7334bca1ac402ac5a10c1
Opcode Fuzzy Hash: 32262c2494f33215c175c432897ca5d6022cad93eefe2bdf93c05b431b17c7a5
Instruction Fuzzy Hash: C972673162DB5E4FE369DB28C4615B577E1FF99300B0145BED48AC72A2DE28E946CBC0

Function 00007FFD9B8A94D8 Relevance: 2.2, Strings: 1, Instructions: 919
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HW_L, xrefs: 00007FFD9B8ADBCE

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID: HW_L
API String ID: 0-1415502811
Opcode ID: 4903d728348f5f61067c8b607eaad745448a018a1468291dc46444fa18518113
Instruction ID: 093fcb417e7854f861968a02a0032059bf31303526373bdb9f6825199141e36a
Opcode Fuzzy Hash: 4903d728348f5f61067c8b607eaad745448a018a1468291dc46444fa18518113
Instruction Fuzzy Hash: 8052C330B0DA0D8FDB68EB68D465A7977E1FF59300B1501BEE44EC72A2DE24ED428791

Function 00007FFD9B980050 Relevance: 2.1, Instructions: 2133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769715977.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f084b69afa8f692dc11eea5e91623c2945a6ea96fd4517dc8fc9a72d7ecfc5
Instruction ID: e78791e6e6f019bcac611f7e6cdc97c5006c8aef892421df6ad18d2e4344cf91
Opcode Fuzzy Hash: 89f084b69afa8f692dc11eea5e91623c2945a6ea96fd4517dc8fc9a72d7ecfc5
Instruction Fuzzy Hash: 89E24B7191FBC95FEB66CB6888655A47FE0FF56700F0A01FED089CB0A3DA286946C741

Function 00007FFD9B8A43EC Relevance: 1.7, Strings: 1, Instructions: 469COMMON

Download Yara Rule

Strings

fish, xrefs: 00007FFD9B8A4440

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 86bb3f72c4df4581bf8e30246415264d92b4ab5d0939f7642d7bc2d66f0b2f6b
Instruction ID: 26f2bb3633e96134bb25154cb2c0841f549c8d59d26aaa643349e2b42f0ae5ec
Opcode Fuzzy Hash: 86bb3f72c4df4581bf8e30246415264d92b4ab5d0939f7642d7bc2d66f0b2f6b
Instruction Fuzzy Hash: FED15C30B1DA4E4FE75CAB6898655B573E1FF9A310B05417EE48BC31E3ED28A8428791

Function 00007FFD9B8AC281 Relevance: 1.4, Instructions: 1440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f632513cc554ab00b5e924b841be1d67a3b064fac839239b2dbdcc3f4b5b17e4
Instruction ID: 2697eeaac4e3ff8802aafe026ff57caad2ae467ca84fb7fc336b4b8f029de8c6
Opcode Fuzzy Hash: f632513cc554ab00b5e924b841be1d67a3b064fac839239b2dbdcc3f4b5b17e4
Instruction Fuzzy Hash: B9A2363060DB4E4FE759DB28C8A44A5B7E1FF89301B1545BED08AC72B6DE38E946CB50

Function 00007FFD9B8ABDF9 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973487f683204178a7a0b20f12600cb78bf2d09ef04a0a0221ad17c220504f2e
Instruction ID: a84714b4dcae7ac976b63ec2027a50825e54e556b03ac17d900f55b1caa534d6
Opcode Fuzzy Hash: 973487f683204178a7a0b20f12600cb78bf2d09ef04a0a0221ad17c220504f2e
Instruction Fuzzy Hash: 27F19F3160EB8A4FE32DCB6888A55B577D2FF99301F05467ED4CAC72B1DD28A502CB91

Function 00007FFD9B8A1800 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307acf5d7d8d0d9eb732f8ee39fe7856a9fd698d22da954c703488d394ad8f72
Instruction ID: dfc32982fbdb9963cdf5c15fc9d4c04306e792ec0ae52cb359c7e0d291fa2265
Opcode Fuzzy Hash: 307acf5d7d8d0d9eb732f8ee39fe7856a9fd698d22da954c703488d394ad8f72
Instruction Fuzzy Hash: 92B10330B1D54E4FE768ABAC94A16B977D2EF8D340F1501BAD00FC72E6DD28AD42C251

Function 00007FFD9B8B4759 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac81050aad6ab73da498018f065922e7381cf445300313bade238d2601520e3b
Instruction ID: e0373435e91b1024e98ab4c6465e1d8e8c3f57b45c48378a177a01a5ef202c14
Opcode Fuzzy Hash: ac81050aad6ab73da498018f065922e7381cf445300313bade238d2601520e3b
Instruction Fuzzy Hash: 82515C32A0E7994FD31D9A7898660753BE1DB8732070982BFD4C7CB1E7E924A807C794

Function 00007FFD9B8A87ED Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

AK_L, xrefs: 00007FFD9B8BE3EF

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID: AK_L
API String ID: 0-1013632581
Opcode ID: 5274aecb0320b1874d75dd0640ec07c25dc371b40da983159906d8133abd4042
Instruction ID: 665868c5730a7b9f4317fcf1f23a0c13b6993ca2ec9272b154e32998738612cd
Opcode Fuzzy Hash: 5274aecb0320b1874d75dd0640ec07c25dc371b40da983159906d8133abd4042
Instruction Fuzzy Hash: E4B14632B0DA594FE76CDB6C98565B4B7D1FF98311F10067EE089C32A6ED64A8428BC1

Function 00007FFD9B8A33EA Relevance: 1.6, APIs: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8A34C1

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a5b27c52da5b7666745ba61fd97a5b5f6e3d821cd5d75fb2341a28ec5da2d31
Instruction ID: b1ed8c45b792080a2fa222493bb0fb325ea437365eeec1d8504c3054ec98c3a1
Opcode Fuzzy Hash: 8a5b27c52da5b7666745ba61fd97a5b5f6e3d821cd5d75fb2341a28ec5da2d31
Instruction Fuzzy Hash: EA412730A0DB884FDB1ADBA898466F97FF1EF56321F0442AFD049C35E2CB646856C791

Function 00007FFD9B8A1D4D Relevance: 1.6, APIs: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8A34C1

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f6462851260b5753a6d730c1a24451e8a72d5f4893a088a51ae44fbaf22cc999
Instruction ID: 2ffb010ebbd6226426c8af101847e550c0187d3b8ee4756d10f5434dd4494969
Opcode Fuzzy Hash: f6462851260b5753a6d730c1a24451e8a72d5f4893a088a51ae44fbaf22cc999
Instruction Fuzzy Hash: 35314A31A0DB4C8FDB19DBAC98556F87BE0EF66321F04426FE04AC31A3DB606856C791

Function 00007FFD9B8A1D68 Relevance: 1.6, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8A34C1

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b3af74bcb500b457844bdd126040e70dbd88b811ab9ee1eedc316eba3bd2a1e1
Instruction ID: daf410ef000b53751efd39c8076ab18a6612d4009b5929f939787cbc693a634d
Opcode Fuzzy Hash: b3af74bcb500b457844bdd126040e70dbd88b811ab9ee1eedc316eba3bd2a1e1
Instruction Fuzzy Hash: 0A310831A0DA4C8FDB18DF9898456F97BF1EB69311F00426FD04AC36A2DB706856C791

Function 00007FFD9B8B84B9 Relevance: 1.6, APIs: 1, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8B8561

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: da6b3892d0cbbea923c9cf0655485afa58055e1fb8238ab84fbaa5af67a7a6e6
Instruction ID: f7246017e8dae48d68c725421d1fbbdbd06455ba7d361fc5ae390df7394f6f87
Opcode Fuzzy Hash: da6b3892d0cbbea923c9cf0655485afa58055e1fb8238ab84fbaa5af67a7a6e6
Instruction Fuzzy Hash: CF31B431A0CB5C8FDB18DFA8984A6F97BF1EF99321F04426FD049C3192DB646856CB91

Function 00007FFD9B8A0921 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8A09BF

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: f16cf471a4b2898be54b3b3e04cce0fc67701934e648359ea175b4a78f88b5f9
Instruction ID: 0b2b2e2b3c8b292711450f6519da30f565639a041b33c69fe522ae4b5fda76ba
Opcode Fuzzy Hash: f16cf471a4b2898be54b3b3e04cce0fc67701934e648359ea175b4a78f88b5f9
Instruction Fuzzy Hash: EC31613150C7488FDB19DF98D885BEABBF0EF56320F0442AED099C3552D768A546CB51

Function 00007FFD9B9810C9 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769715977.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3c028cf7df453a505114ebd12de17dcac21baddf86e8b5d98a405787f529d3
Instruction ID: 3ab6e9fadee084a4b61e022665e6c79153320b61f3680f82ef3f9729c0686f25
Opcode Fuzzy Hash: 7f3c028cf7df453a505114ebd12de17dcac21baddf86e8b5d98a405787f529d3
Instruction Fuzzy Hash: F2414831A0EA8D5FDB56DF68C8645E87FF0FF59304B0A01EBD44ACB1A2DA34A945C780

Non-executed Functions

Function 00007FFD9B8A14F8 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769247200.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_RFQ SY103 2nd order 2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da79ac742dadd015afe35fe729c607334b191c5c3549d819400010a6d219743c
Instruction ID: 97ca235c975d4ef9c39853891bb3a5a3156b58d98d7fc052b3be8499dc415550
Opcode Fuzzy Hash: da79ac742dadd015afe35fe729c607334b191c5c3549d819400010a6d219743c
Instruction Fuzzy Hash: ABD17931B1EA4A4FE379DFA89861571B7D0EF55310B1542BED09AC31E7EA24F9438390

Analysis Process: jsc.exePID: 7404, Parent PID: 7296COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	9

Executed Functions

Function 0112D0A8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0112D136
GetCurrentThread.KERNEL32 ref: 0112D173
GetCurrentProcess.KERNEL32 ref: 0112D1B0
GetCurrentThreadId.KERNEL32 ref: 0112D209

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 961c6bbbaf72e0ba82dd0f8078cf9bc45068772f4a5c2a5f6db47a10aa78c04c
Instruction ID: 4e199c713028b2e447f75fa89d0ff1006b29b8f59d397fccc7f8bb397fb2b6ac
Opcode Fuzzy Hash: 961c6bbbaf72e0ba82dd0f8078cf9bc45068772f4a5c2a5f6db47a10aa78c04c
Instruction Fuzzy Hash: 675135B0D012498FDB48DFA9D548BDEBBF1EF48314F208459E459AB3A0DB349984CF65

Function 0112D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0112D136
GetCurrentThread.KERNEL32 ref: 0112D173
GetCurrentProcess.KERNEL32 ref: 0112D1B0
GetCurrentThreadId.KERNEL32 ref: 0112D209

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 91e430cd934cd0bb91ab242ff5deb7dc0accc4866a9e9e5fb93ea7bd6eaf924c
Instruction ID: cb86cdb76ccf62be31d4f138e8dc5d1390c3ce5bccb1cf07cd1a18498f88b273
Opcode Fuzzy Hash: 91e430cd934cd0bb91ab242ff5deb7dc0accc4866a9e9e5fb93ea7bd6eaf924c
Instruction Fuzzy Hash: 9F5135B09012498FDB18DFAAD548BDEBBF1EF48314F20C459E459A73A0DB349984CF65

Function 0112AE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0112B086

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ad555849d34a6f90bdbb5af665ea860a6070e76ffe1a1d1435676e73fe7b5c23
Instruction ID: d6218fc3b9f23810248a5d402436a7fe72dade483da51da1cd0a7219954e04cb
Opcode Fuzzy Hash: ad555849d34a6f90bdbb5af665ea860a6070e76ffe1a1d1435676e73fe7b5c23
Instruction Fuzzy Hash: E58147B0A00B158FD728DF29E14079ABBF1FF48304F10892ED586DBA50D779E85ACB95

Function 01125935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011259F1

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 49cd4716e320028a73f589e8fb7e1728a5a70b6c990b42ad118e142d9e4f7ee0
Instruction ID: f0e9a4999750d44070757577840ac495e3349bc2f890a2be5f4ae4f7e29bcc58
Opcode Fuzzy Hash: 49cd4716e320028a73f589e8fb7e1728a5a70b6c990b42ad118e142d9e4f7ee0
Instruction Fuzzy Hash: C041F2B0C00729CFDB24CFAAC884BDDBBB5BF48304F24805AD408AB254DB755989CF90

Function 01124248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011259F1

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4e85fd8257bee8e2c790dcb62bf121bc7052fe43840f4f427b6f50131d5f81fe
Instruction ID: 6249bec9eafd6fc027702712adbf3692ee6a56393ea241cc1a87d1d316a5aff3
Opcode Fuzzy Hash: 4e85fd8257bee8e2c790dcb62bf121bc7052fe43840f4f427b6f50131d5f81fe
Instruction Fuzzy Hash: 4F41E1B0D00729CADB28CFAAC884BDDBBB6FF45304F24805AD408AB255DB756945CF90

Function 0112D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0112D387

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3440bd9a89e482817ec8f42a558ed930f72892bc82fa09d3a39a95d20c506321
Instruction ID: c697087ad2c6ed8204261e5d02936f48dc478c3293dd7bbc26c8ec6f7113d4e6
Opcode Fuzzy Hash: 3440bd9a89e482817ec8f42a558ed930f72892bc82fa09d3a39a95d20c506321
Instruction Fuzzy Hash: F621E2B5900218DFDB10CFAAD984ADEBFF8FB48320F14801AE918A7350C374A954CFA4

Function 0112D2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0112D387

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3099bbf31816ad6d50efd2847c78050a4c1428361dc4be3f46a80035fcd8b11
Instruction ID: 9a8c469ec73a08ac8a27b1d79c462894247ebc836dd173249473cd89f844615c
Opcode Fuzzy Hash: e3099bbf31816ad6d50efd2847c78050a4c1428361dc4be3f46a80035fcd8b11
Instruction Fuzzy Hash: 8D21E4B5D00218DFDB10CFAAD585AEEBBF4FB48324F14841AE958A7250C378A954CFA4

Function 0112A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0112B101,00000800,00000000,00000000), ref: 0112B312

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 91f57f86f9efab77c1f7250121ef1b3b08eb340cc2e71d1e4c4b1d9d793da927
Instruction ID: ff9e712a6785fa4a2d8c290857b75971054fa1d16eb8463b902d8f7e38fd35dc
Opcode Fuzzy Hash: 91f57f86f9efab77c1f7250121ef1b3b08eb340cc2e71d1e4c4b1d9d793da927
Instruction Fuzzy Hash: D01112B6D043598FDB14CF9AD444AEEFBF4EB48320F10842AE919A7310C375A954CFA9

Function 0112B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0112B101,00000800,00000000,00000000), ref: 0112B312

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 64ffcb4dae835698701bec3344dc257f794a5b5d40b11f1923a2302180236e16
Instruction ID: b6c31a8daaf1058d6a1794a0c9ab1728a924530cfd1f3c7bc01af0da716dad0e
Opcode Fuzzy Hash: 64ffcb4dae835698701bec3344dc257f794a5b5d40b11f1923a2302180236e16
Instruction Fuzzy Hash: 5F1112B69042598FDB14CF9AC444ADEFFF4EB48320F14842AD969A7210C375A545CFA4

Function 0112B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0112B086

Memory Dump Source

Source File: 00000003.00000002.1726592287.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_jsc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3c5a7df94f3caa88044791460492a95d17e0b8f6acaf5b78402d913b47c40f1d
Instruction ID: 51345c4cf3365fd9859cd65271bc5533573b6c9508b7f4777424a909b3f790c9
Opcode Fuzzy Hash: 3c5a7df94f3caa88044791460492a95d17e0b8f6acaf5b78402d913b47c40f1d
Instruction Fuzzy Hash: 391110B5C00359CFDB24CF9AC444ADEFBF4AB88324F10842AD468B7210C379A545CFA9

Function 010BD654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726237757.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10bd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbe05fd93b24da44817bf469a1462a95cf1a51be1fc4200078d84a682d42798
Instruction ID: 5aa32e786009a172c2e3836246fd1d2bd2409889f71cb0aea344de633c230f81
Opcode Fuzzy Hash: fdbe05fd93b24da44817bf469a1462a95cf1a51be1fc4200078d84a682d42798
Instruction Fuzzy Hash: 2B210675540240DFCB05DF54D9C4BAAFFA5FB88318F24C6A9E9890B256C336D416CBA1

Function 010BD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726237757.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10bd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7851bbe3d9fc21ef57732ca4f0429501f7e453bbe637349b8bb288cb429856
Instruction ID: 9b28818389f43c8d9e51c186d69589621ffdbe53a0fc994fd6c7da8ac93d4370
Opcode Fuzzy Hash: ad7851bbe3d9fc21ef57732ca4f0429501f7e453bbe637349b8bb288cb429856
Instruction Fuzzy Hash: 5C214871500200DFDB05DF48C9C0B9AFFA5FB84318F20C5A9E9490B256C73AE446C7A1

Function 010CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726299054.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10cd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfff496c2fd2d59e1056d58d19f8d75be1a14d223bfffe1ffd66d8f8ddcf0b3
Instruction ID: 48a538a30b3d43ed41920839f9f4c171d21a275ca964aee91d0eae593d4f9e72
Opcode Fuzzy Hash: ccfff496c2fd2d59e1056d58d19f8d75be1a14d223bfffe1ffd66d8f8ddcf0b3
Instruction Fuzzy Hash: 2D210071604200DFCB15DF98D984B2ABBA5EB84B14F30C5BDE98A4B256C33AD447CBA1

Function 010CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726299054.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10cd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4142cc12e9d7e50139fd5abbe81a4d497d385cc556a12dba391739ad1f5f66bf
Instruction ID: 8ffdac30e10e75307bd13f033a9a1e93c8bd15f1656f3c3fbf4cb70b061cdb56
Opcode Fuzzy Hash: 4142cc12e9d7e50139fd5abbe81a4d497d385cc556a12dba391739ad1f5f66bf
Instruction Fuzzy Hash: 352195755083809FCB03CF58D994715BFB1EB46314F24C5EAD8898F2A7C33A9806CBA2

Function 010BD64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726237757.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10bd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 067373be2606693e63e44b37ea80bf5cf484ed15668506f71fb0080b9802b039
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: D621CD76404280DFCB06CF44D9C4B96BFB2FB88318F24C2A9D9880A256C33AD426CB91

Function 010BD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726237757.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10bd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 17ad2b4331c8054568e1761c09e32ee005b400d371109a2da8734567394db718
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1C11DF72404240CFDB02CF44D5C4B96FFB1FB94328F24C6A9D9490B256C33AE45ACBA2

Function 010BDA1D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726237757.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10bd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66222ec88845a6d653b725109a97d6a61fd6041d163dbf4b29afdbd2659b418e
Instruction ID: a3d00ba653e877c801de88c6f7fb9e06c675d6b0c6ffc6f7b2a2c55a34ea555f
Opcode Fuzzy Hash: 66222ec88845a6d653b725109a97d6a61fd6041d163dbf4b29afdbd2659b418e
Instruction Fuzzy Hash: B0012B7100D3009AE7118A59CDC47A7FFD8EF41328F08C469ED880F286C279D840C7B1

Function 010BDA1C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1726237757.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10bd000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ac2e3cd150f588b8fc1711c87b7b969aba4a41d75a0de8b6aabc20c6c74260
Instruction ID: 9b77ff4b398febb96f5d5829ca43b5796aba6bd001601c9a893f07055c4c40e8
Opcode Fuzzy Hash: e7ac2e3cd150f588b8fc1711c87b7b969aba4a41d75a0de8b6aabc20c6c74260
Instruction Fuzzy Hash: 9DF06271409344AEE7118A1AC8C4BA2FFE8EB41628F18C55AED484E286C2799844DBB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ SY103 2nd order 2024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RFQ SY103 2nd or_7be5a683b7ce35d984490767b86aac2a29b92f_5fa42fed_c184db70-752d-49d4-972d-f3d88664d989\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F3C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2103.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Possible Origin

Windows Analysis Report
RFQ SY103 2nd order 2024.exe

Function 00007FFD9B8A94D8 Relevance: 2.2, Strings: 1, Instructions: 919
COMMON

Function 00007FFD9B8A87ED Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 389
COMMON

Function 0112D0A8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 0112D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0112AE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Function 01125935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 01124248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0112D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON