Edit tour

Windows Analysis Report
1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Overview

General Information

Sample name:	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Analysis ID:	1467918
MD5:	dd1bd551108f3ec1e9e775c7b09a0e1c
SHA1:	418ec6e49557849276c4a8198b92eff0af4b957f
SHA256:	e347ded6059659a1c81d016b64bb550d7fe94fb789957ed5f312eacebb8944db
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected AgentTesla

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe" MD5: DD1BD551108F3EC1E9E775C7B09A0E1C)

fMNDB.exe (PID: 7616 cmdline: "C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe" MD5: DD1BD551108F3EC1E9E775C7B09A0E1C)

fMNDB.exe (PID: 7796 cmdline: "C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe" MD5: DD1BD551108F3EC1E9E775C7B09A0E1C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.raczki.pl", "Username": "wojt@raczki.pl", "Password": "obslugaradygminy"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000003.00000002.2893613189.000000000260F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2893797859.00000000027DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1832183101.000000000258F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe PID: 7416	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe PID: 7416	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: fMNDB.exe PID: 7616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fMNDB.exe PID: 7616	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: fMNDB.exe PID: 7796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fMNDB.exe PID: 7796	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 61 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
3.2.fMNDB.exe.228f61e.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.228f61e.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.228f61e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.228f61e.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.3594190.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3594190.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.3594190.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.3594190.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
3.0.fMNDB.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.fMNDB.exe.3545570.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3545570.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.3545570.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.3545570.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.3.fMNDB.exe.714da8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.3.fMNDB.exe.714da8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.3.fMNDB.exe.714da8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.fMNDB.exe.714da8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
3.2.fMNDB.exe.35c6458.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.35c6458.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.35c6458.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.35c6458.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.0.fMNDB.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 07 88 44 24 2B 88 44 24 2F B0 62 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.fMNDB.exe.50e0000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.50e0000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.50e0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.50e0000.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.4a80ee8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.4a80ee8.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.4a80ee8.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.4a80ee8.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.3594190.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3594190.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.3594190.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.3594190.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.3.fMNDB.exe.7d19c8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.3.fMNDB.exe.7d19c8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.3.fMNDB.exe.7d19c8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.3.fMNDB.exe.7d19c8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.2240506.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.2240506.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.2240506.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.2240506.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.223f61e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.223f61e.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.223f61e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.3.fMNDB.exe.7d19c8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.3.fMNDB.exe.7d19c8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.4a80000.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.4a80000.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.4a80000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2560ee8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.4a80000.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.2560000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.2560000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.2560000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2560000.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.223f61e.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.3614190.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.3614190.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.3614190.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.228f61e.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3545570.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3545570.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.3545570.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.35c6458.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.35c6458.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.35c6458.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.3546458.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3546458.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.3546458.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.50e0000.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.50e0000.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.50e0000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.228f61e.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.228f61e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.3545570.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8f090:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8f102:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8f18c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8f21e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8f288:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8f2fa:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8f390:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8f420:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.3.fMNDB.exe.7d19c8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.228f61e.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.3.fMNDB.exe.7d19c8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.35c6458.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8e1a8:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8e21a:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8e2a4:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8e336:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8e3a0:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8e412:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8e4a8:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8e538:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.2560ee8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.2560ee8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2560ee8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.3546458.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.50e0000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.3614190.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.3614190.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.3614190.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.3614190.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.3614190.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2290506.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.2290506.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.2290506.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.2290506.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.4b20000.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.4b20000.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.4b20000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.4b20000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.2560000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.2560000.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.2560000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2560000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.2240506.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.2240506.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.2240506.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.2240506.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.2290506.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.2290506.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.2290506.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2290506.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.3546458.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.3546458.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.3546458.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.3546458.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8e1a8:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8e21a:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8e2a4:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8e336:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8e3a0:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8e412:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8e4a8:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8e538:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.35c5570.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.35c5570.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.35c5570.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.35c5570.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f558:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f5ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f654:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f6e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f750:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f7c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f858:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f8e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.3.fMNDB.exe.714da8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.3.fMNDB.exe.714da8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.3.fMNDB.exe.714da8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.35c5570.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.35c5570.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.35c5570.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.fMNDB.exe.714da8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.35c5570.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8f090:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8f102:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8f18c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8f21e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8f288:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8f2fa:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8f390:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8f420:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.4b20000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.4b20000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.4b20000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.4b20000.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.4a80000.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.4a80000.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.4a80000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.4a80000.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.fMNDB.exe.2560ee8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.fMNDB.exe.2560ee8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.fMNDB.exe.2560ee8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.fMNDB.exe.2560ee8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8f090:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8f102:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8f18c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8f21e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8f288:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8f2fa:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8f390:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8f420:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.4a80ee8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.4a80ee8.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.4a80ee8.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.4a80ee8.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e670:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e6e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e76c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e7fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e868:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e8da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e970:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea00:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.fMNDB.exe.223f61e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.fMNDB.exe.223f61e.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.fMNDB.exe.223f61e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.fMNDB.exe.223f61e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41358:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x413ca:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41454:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x414e6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41550:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x415c2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41658:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x416e8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8e1a8:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8e21a:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8e2a4:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8e336:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8e3a0:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8e412:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8e4a8:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8e538:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40470:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x404e2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4056c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x405fe:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40668:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x406da:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40770:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40800:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 217 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, ProcessId: 7416, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fMNDB

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.49.148.195, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, Initiated: true, ProcessId: 7416, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

Avira: detection malicious, Label: TR/Spy.Gen8

Found malware configuration

Source: 1.2.fMNDB.exe.3546458.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.raczki.pl", "Username": "wojt@raczki.pl", "Password": "obslugaradygminy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Joe Sandbox ML: detected

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:

Binary string: _.pdb source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000003.1740970421.0000000000762000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.49.148.195:587

Source: Joe Sandbox View

IP Address: 185.49.148.195 185.49.148.195

Source: Joe Sandbox View

ASN Name: PL-BEYOND-ASPL PL-BEYOND-ASPL

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.49.148.195:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.raczki.pl

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/dvcasha2.crl0q
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dvcasha2.ocsp-certum.com04
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.raczki.pl
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raczki.pl
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/dvcasha2.cer0
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, SKTzxzsJw.cs

.Net Code: JTHNI

System Summary

Malicious sample detected (through community Yara rule)

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 3.0.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.0.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0040DC11	0_2_0040DC11
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00407C3F	0_2_00407C3F
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00418CCC	0_2_00418CCC
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00406CA0	0_2_00406CA0
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_004028B0	0_2_004028B0
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0041A4BE	0_2_0041A4BE
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00418244	0_2_00418244
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00401650	0_2_00401650
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00402F20	0_2_00402F20
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_004193C4	0_2_004193C4
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00418788	0_2_00418788
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00402F89	0_2_00402F89
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00402B90	0_2_00402B90
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_004073A0	0_2_004073A0
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0219CC78	0_2_0219CC78
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0219D890	0_2_0219D890
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_02190F40	0_2_02190F40
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_02190FD0	0_2_02190FD0
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0219CFC0	0_2_0219CFC0
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_02191030	0_2_02191030
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_02778AC8	0_2_02778AC8
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_027758E8	0_2_027758E8
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0277E6C8	0_2_0277E6C8
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0277C418	0_2_0277C418
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_02770040	0_2_02770040
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_02770007	0_2_02770007
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0277B608	0_2_0277B608
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_05B699A9	0_2_05B699A9
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_05B65A90	0_2_05B65A90
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_05B64AF8	0_2_05B64AF8
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_05B67F58	0_2_05B67F58
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_05B609F8	0_2_05B609F8
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0636DA89	0_2_0636DA89
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_063678E0	0_2_063678E0
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_06366078	0_2_06366078
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_020BCC78	1_2_020BCC78
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_020BD890	1_2_020BD890
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_020BCFC0	1_2_020BCFC0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_020B0FD0	1_2_020B0FD0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_020B1030	1_2_020B1030
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B3E598	1_2_05B3E598
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B3C2C0	1_2_05B3C2C0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B352C8	1_2_05B352C8
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B38D0F	1_2_05B38D0F
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B3ECBF	1_2_05B3ECBF
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B30013	1_2_05B30013
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B30040	1_2_05B30040
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B699A9	1_2_05B699A9
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B67CA0	1_2_05B67CA0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B65A98	1_2_05B65A98
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B646FA	1_2_05B646FA
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B609F8	1_2_05B609F8
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_0077D8A0	3_2_0077D8A0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_0077CC88	3_2_0077CC88
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_0077CFD0	3_2_0077CFD0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_00771030	3_2_00771030
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_00770FD0	3_2_00770FD0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059FE598	3_2_059FE598
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059F578A	3_2_059F578A
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059F8968	3_2_059F8968
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059FC2C0	3_2_059FC2C0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059FECBF	3_2_059FECBF
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059F0006	3_2_059F0006
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059F0040	3_2_059F0040
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_05A246FB	3_2_05A246FB
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_05A27CA0	3_2_05A27CA0
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_05A299A9	3_2_05A299A9
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_05A25A98	3_2_05A25A98
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_05A209F8	3_2_05A209F8
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_06237400	3_2_06237400
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_0623D5E9	3_2_0623D5E9
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_06235B98	3_2_06235B98

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Code function: String function: 0040E1D8 appears 43 times

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000003.1624911204.0000000000849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2891200196.0000000000198000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Binary or memory string: OriginalFilename158bf27d-8add-42b0-9c59-29d7b3834f24.exe4 vs 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 3.0.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.0.fMNDB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Static PE information: Section: .rsrc ZLIB complexity 0.9948172982283464
Source: fMNDB.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9948172982283464

Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@1/1

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

0_2_004019F0

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

File created: C:\Users\user\AppData\Roaming\fMNDB

Jump to behavior

Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Command line argument: 08A

0_2_00413780

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

File read: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe "C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe "C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe "C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe"

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

0_2_004019F0

Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Static PE information: real checksum: 0x23bfb should be: 0x42aeb
Source: fMNDB.exe.0.dr	Static PE information: real checksum: 0x23bfb should be: 0x42aeb

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0040E21D push ecx; ret	0_2_0040E230
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0040BB97 push dword ptr [ecx-75h]; iretd	0_2_0040BBA3
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0219435B push esp; iretd	0_2_02194361
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0636B0A5 push es; ret	0_2_0636B0AC
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_06360C80 push es; ret	0_2_06360C90
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_020B435B push esp; iretd	1_2_020B4361
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 1_2_05B68408 push eax; retf	1_2_05B68411
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_0077435B push esp; iretd	3_2_00774361
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_059F431F pushad ; iretd	3_2_059F4335
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Code function: 3_2_06230790 push es; ret	3_2_062307A0

Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'qtSgq8WCW5EZy', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'qtSgq8WCW5EZy', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'qtSgq8WCW5EZy', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'qtSgq8WCW5EZy', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'qtSgq8WCW5EZy', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'qtSgq8WCW5EZy', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

File created: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fMNDB			Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fMNDB			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

File opened: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Memory allocated: 23C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Memory allocated: 2070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Memory allocated: 2540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Memory allocated: 770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

0_2_004019F0

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Window / User API: threadDelayed 1401	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Window / User API: threadDelayed 8178	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Window / User API: threadDelayed 2932	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Window / User API: threadDelayed 6913	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Window / User API: threadDelayed 6557	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Window / User API: threadDelayed 2667	Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7504	Thread sleep count: 1401 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -99843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -99724s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7504	Thread sleep count: 8178 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -99556s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -99326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -98013s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96481s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96222s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -96078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95962s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -95093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -94208s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe TID: 7496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -41505174165846465s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7712	Thread sleep count: 2932 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99865s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7712	Thread sleep count: 6913 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99624s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99405s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99296s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -99077s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98851s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98744s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98510s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98341s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -98070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97624s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97404s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97296s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -97077s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96418s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -96093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95872s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95763s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95647s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95419s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -95109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7704	Thread sleep time: -94234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7936	Thread sleep count: 6557 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7936	Thread sleep count: 2667 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99233s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98895s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98651s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98384s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98135s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97921s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -97046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96390s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95950s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95841s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95733s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95624s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95340s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95122s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -95015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -94904s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -94796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -94687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe TID: 7924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 99843	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 99724	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 99556	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 99326	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98689	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98124	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 98013	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97249	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96702	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96586	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96481	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96374	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96222	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 96078	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95962	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95859	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95749	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95640	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95531	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95421	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95312	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95203	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 95093	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94984	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94874	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94765	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94656	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94546	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94437	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94327	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 94208	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99865	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99624	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99405	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99296	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99077	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98851	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98744	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98510	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98341	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98187	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98070	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97843	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97624	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97515	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97404	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97296	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97187	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97077	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96749	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96418	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95872	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95763	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95647	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95419	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94452	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99233	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98895	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98651	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98384	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98247	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98135	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 97046	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96937	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96718	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96390	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96171	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95950	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95841	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95733	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95624	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95515	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95340	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95122	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 95015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94904	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 94687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllstringPNPDeviceID
Source: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

API call chain: ExitProcess graph end node

graph_0-52077

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040CE09

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

0_2_004019F0

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

0_2_004019F0

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree,

0_2_0040ADB0

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040CE09
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040E61C
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416F6A
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Code function: 0_2_004123F1 SetUnhandledExceptionFilter,	0_2_004123F1

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Code function: GetLocaleInfoA,

0_2_00417A20

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412A15

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893613189.000000000260F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893797859.00000000027DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1832183101.000000000258F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fMNDB.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fMNDB.exe PID: 7796, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fMNDB.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fMNDB.exe PID: 7796, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893613189.000000000260F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893797859.00000000027DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1832183101.000000000258F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fMNDB.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fMNDB.exe PID: 7796, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2540000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3594190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3545570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c6458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.50e0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.228f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.fMNDB.exe.7d19c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.3614190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.2240506.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2290506.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.3546458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.224f61e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.fMNDB.exe.714da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.35c5570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.4b20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.2250506.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fMNDB.exe.2560ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3795570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.4a80ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.24b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.37e4190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.fMNDB.exe.223f61e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.3796458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe.7c9510.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	1 Credentials in Registry	35 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	100%	Avira	TR/Spy.Gen8
1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	100%	Avira	TR/Spy.Gen8
C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://raczki.pl	0%	Avira URL Cloud	safe
http://www.certum.pl/CPS0	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com01	0%	Avira URL Cloud	safe
https://www.certum.pl/CPS0	0%	Avira URL Cloud	safe
http://mail.raczki.pl	0%	Avira URL Cloud	safe
http://crl.certum.pl/ctnca.crl0k	0%	Avira URL Cloud	safe
http://repository.certum.pl/ctnca.cer09	0%	Avira URL Cloud	safe
http://crl.certum.pl/dvcasha2.crl0q	0%	Avira URL Cloud	safe
http://repository.certum.pl/dvcasha2.cer0	0%	Avira URL Cloud	safe
http://dvcasha2.ocsp-certum.com04	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raczki.pl	185.49.148.195	true	true		unknown
mail.raczki.pl	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.certum.pl/dvcasha2.crl0q	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.raczki.pl	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://raczki.pl	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, fMNDB.exe, 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.certum.pl/CPS0	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca.crl0k	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dvcasha2.ocsp-certum.com04	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/dvcasha2.cer0	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894648241.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2894752336.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe, 00000000.00000002.2893797859.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834069251.0000000005AAC000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1834029976.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1832183101.0000000002597000.00000004.00000800.00020000.00000000.sdmp, fMNDB.exe, 00000001.00000002.1831173926.0000000000704000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2895035340.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2892324240.000000000080C000.00000004.00000020.00020000.00000000.sdmp, fMNDB.exe, 00000003.00000002.2893613189.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.49.148.195	raczki.pl	Poland		31229	PL-BEYOND-ASPL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467918
Start date and time:	2024-07-05 01:28:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 160 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Simulations

Behavior and APIs

Time	Type	Description
00:28:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fMNDB C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe
00:29:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fMNDB C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe
19:28:52	API Interceptor	49x Sleep call for process: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe modified
19:29:03	API Interceptor	113x Sleep call for process: fMNDB.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.49.148.195	MFRtbb58Qh.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	N#U00b0 2400718.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	C4N6-0008399495-3353853121 TH C L09.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	101764ZAM2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	101764ZAM2024.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse
	PL_PLK_PT_filter_I-534_wheels_krotki.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PL-BEYOND-ASPL	MFRtbb58Qh.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.49.148.195
	Order-1351125X.docx.doc	Get hash	malicious	FormBook	Browse	5.149.161.103
	N#U00b0 2400718.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.49.148.195
	http://ceva.r-shop.eu	Get hash	malicious	Unknown	Browse	2.57.138.83
	C4N6-0008399495-3353853121 TH C L09.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.49.148.195
	101764ZAM2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	185.49.148.195
	101764ZAM2024.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.49.148.195
	PL_PLK_PT_filter_I-534_wheels_krotki.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	185.49.148.195
	t3CBipL4lt.elf	Get hash	malicious	Mirai	Browse	91.102.119.171
	http://dkdeep.com/?placement%5C=Facebook_Desktop_Feed&adset_name%5C=26&ad_name%5C=1_267069722828906&fb%5C=267069722828906&ad_id%5C=120206568353510682&buyer%5C=mk&netProbitiya2k23%5C=w0tth3b3stGmev3R&pre%5C=celeb1&fbclid%5C=IwAR2SLF2yfFVFau_BLIzVYgyo3FnJIWRI2bBRkxat54PFXlIdShtFrFBG6Pg	Get hash	malicious	Unknown	Browse	5.149.162.7

Process:	C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	269312
Entropy (8bit):	7.543647615959605
Encrypted:	false
SSDEEP:	6144:IDKW1Lgbdl0TBBvjc/B8Q1PS20j9VS2u0zna:Oh1Lk70TnvjcZ8Q1KxS2a
MD5:	DD1BD551108F3EC1E9E775C7B09A0E1C
SHA1:	418EC6E49557849276C4A8198B92EFF0AF4B957F
SHA-256:	E347DED6059659A1C81D016B64BB550D7FE94FB789957ED5F312EACEBB8944DB
SHA-512:	7DFC26E555B3F3291264C73E3F52E62ED417B17AA8A3417AA0C7117C25C1592C3221D517E08AB498E076362AF04F302E58C8496B5542C10E05F23DC5AAE7DE5C
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~.................._f....PE..L...t..P..........#................./.............@..........................`.......;..........................................P....`..x...............................................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc...x....`....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.543647615959605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
File size:	269'312 bytes
MD5:	dd1bd551108f3ec1e9e775c7b09a0e1c
SHA1:	418ec6e49557849276c4a8198b92eff0af4b957f
SHA256:	e347ded6059659a1c81d016b64bb550d7fe94fb789957ed5f312eacebb8944db
SHA512:	7dfc26e555b3f3291264c73e3f52e62ed417b17aa8a3417aa0c7117c25c1592c3221d517e08ab498e076362af04f302e58c8496b5542c10e05f23dc5aae7de5c
SSDEEP:	6144:IDKW1Lgbdl0TBBvjc/B8Q1PS20j9VS2u0zna:Oh1Lk70TnvjcZ8Q1KxS2a
TLSH:	A144D02035C0D1B3C477017085E6CA669E3974760B6AD5D3BAED2BBA6F213D163362CE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~.................._f....PE..L...t..P..........#........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40cd2f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5000A574 [Fri Jul 13 22:47:16 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf5a4aa99e5b160f8521cadd6bfe73b8

Entrypoint Preview

Instruction
call 00007F1B81159EA6h
jmp 00007F1B81154069h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F1B811541CEh
test byte ptr [eax], 00000008h
je 00007F1B811541C9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413563h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C4Ah
mov dword ptr [004228ECh], 00412BFEh
mov dword ptr [004228F0h], 00412C37h
mov dword ptr [004228F4h], 00412BA0h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 004134DBh
mov dword ptr [00422900h], 00412BBCh
mov dword ptr [00422904h], 00412B1Eh
mov dword ptr [00422908h], 00412AABh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007F1B8115415Bh
call 00007F1B8115A9E0h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x1fb78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19718	0x19800	42b7248e125c55e9d0771fea968ec5b1	False	0.5789579503676471	data	6.748591703757032	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6db4	0x6e00	5826801f33fc1b607aa8e942aa92e9fa	False	0.5467329545454546	data	6.442956247632331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	2fe51a72ede820cd7cf55a77ba59b1f4	False	0.3126775568181818	data	3.2625868398009703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x1fb78	0x1fc00	70415c8b9153ecb912f77da4740844bc	False	0.9948172982283464	data	7.9952920528291385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0x26124	0x1f58a	data	1.0003582721934048
RT_RCDATA	0x456b0	0x20	data	1.28125
RT_VERSION	0x456d0	0x2bc	data	0.44285714285714284
RT_MANIFEST	0x4598c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA
ole32.dll	OleInitialize
OLEAUT32.dll	SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysFreeString, SysAllocString

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 01:28:53.314853907 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:53.322422981 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:53.326431990 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:54.642700911 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:54.643795967 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:54.649542093 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:54.839976072 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:54.840183020 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:54.845024109 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.036209106 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.048037052 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:55.052983046 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.256294966 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.256381035 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.256392956 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.256424904 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:55.256594896 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.256632090 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:55.282871962 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:55.288119078 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.478487968 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.490386009 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:55.495274067 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.790760994 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:55.791836977 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:56.012187958 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:56.012265921 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:56.013761044 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:56.204109907 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:56.204417944 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:56.209160089 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:58.424467087 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:58.424748898 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:58.431076050 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:58.794406891 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:58.794511080 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:58.794521093 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:28:58.794562101 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:58.812324047 CEST	49730	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:28:58.817147970 CEST	587	49730	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:04.214262962 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:04.219305992 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:04.219388008 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:05.795300961 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:05.812791109 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:05.817893982 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.008507967 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.010216951 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.015074968 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.206243992 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.229136944 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.233997107 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.435944080 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.435957909 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.435970068 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.436023951 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.436044931 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.436080933 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.437546015 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.442347050 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.632780075 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.649620056 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.654362917 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.844517946 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:06.844880104 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:06.849757910 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:11.040764093 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:11.041245937 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:11.047070980 CEST	587	49731	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:12.716818094 CEST	49731	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:13.291928053 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:13.296736002 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:13.296808958 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:14.443773985 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:14.457401991 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:14.465595007 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:14.656306982 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:14.656478882 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:14.661279917 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:14.914239883 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:14.969197989 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.068625927 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.073489904 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.281018019 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.281105042 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.281116009 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.281166077 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.281363010 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.282398939 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.299122095 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.303889036 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.497390032 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.513044119 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.517761946 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.711158037 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.711488008 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.716254950 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.909799099 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:15.910156965 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:15.914932966 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:18.481009960 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:18.481266022 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:18.490161896 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:18.680521011 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:18.681467056 CEST	587	49736	185.49.148.195	192.168.2.4
Jul 5, 2024 01:29:18.681545973 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:18.686104059 CEST	49736	587	192.168.2.4	185.49.148.195
Jul 5, 2024 01:29:18.690901041 CEST	587	49736	185.49.148.195	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 01:28:53.166657925 CEST	64698	53	192.168.2.4	1.1.1.1
Jul 5, 2024 01:28:53.252038956 CEST	53	64698	1.1.1.1	192.168.2.4
Jul 5, 2024 01:29:13.381287098 CEST	53	49585	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 01:28:53.166657925 CEST	192.168.2.4	1.1.1.1	0xd7e9	Standard query (0)	mail.raczki.pl	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 01:28:53.252038956 CEST	1.1.1.1	192.168.2.4	0xd7e9	No error (0)	mail.raczki.pl	raczki.pl		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 01:28:53.252038956 CEST	1.1.1.1	192.168.2.4	0xd7e9	No error (0)	raczki.pl		185.49.148.195	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 5, 2024 01:28:54.642700911 CEST	587	49730	185.49.148.195	192.168.2.4	220-whm4.i.media.pl ESMTP Exim 4.96.2 #2 Fri, 05 Jul 2024 01:28:54 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 5, 2024 01:28:54.643795967 CEST	49730	587	192.168.2.4	185.49.148.195	EHLO 035347
Jul 5, 2024 01:28:54.839976072 CEST	587	49730	185.49.148.195	192.168.2.4	250-whm4.i.media.pl Hello 035347 [8.46.123.33] 250-SIZE 134217728 250-8BITMIME 250-DSN 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 5, 2024 01:28:54.840183020 CEST	49730	587	192.168.2.4	185.49.148.195	STARTTLS
Jul 5, 2024 01:28:55.036209106 CEST	587	49730	185.49.148.195	192.168.2.4	220 TLS go ahead
Jul 5, 2024 01:29:05.795300961 CEST	587	49731	185.49.148.195	192.168.2.4	220-whm4.i.media.pl ESMTP Exim 4.96.2 #2 Fri, 05 Jul 2024 01:29:05 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 5, 2024 01:29:05.812791109 CEST	49731	587	192.168.2.4	185.49.148.195	EHLO 035347
Jul 5, 2024 01:29:06.008507967 CEST	587	49731	185.49.148.195	192.168.2.4	250-whm4.i.media.pl Hello 035347 [8.46.123.33] 250-SIZE 134217728 250-8BITMIME 250-DSN 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 5, 2024 01:29:06.010216951 CEST	49731	587	192.168.2.4	185.49.148.195	STARTTLS
Jul 5, 2024 01:29:06.206243992 CEST	587	49731	185.49.148.195	192.168.2.4	220 TLS go ahead
Jul 5, 2024 01:29:14.443773985 CEST	587	49736	185.49.148.195	192.168.2.4	220-whm4.i.media.pl ESMTP Exim 4.96.2 #2 Fri, 05 Jul 2024 01:29:14 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 5, 2024 01:29:14.457401991 CEST	49736	587	192.168.2.4	185.49.148.195	EHLO 035347
Jul 5, 2024 01:29:14.656306982 CEST	587	49736	185.49.148.195	192.168.2.4	250-whm4.i.media.pl Hello 035347 [8.46.123.33] 250-SIZE 134217728 250-8BITMIME 250-DSN 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 5, 2024 01:29:14.656478882 CEST	49736	587	192.168.2.4	185.49.148.195	STARTTLS
Jul 5, 2024 01:29:14.914239883 CEST	587	49736	185.49.148.195	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	19:28:50
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe"
Imagebase:	0x400000
File size:	269'312 bytes
MD5 hash:	DD1BD551108F3EC1E9E775C7B09A0E1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2894422236.0000000003791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2893323166.00000000024B0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2893480376.0000000002540000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2892665779.000000000220F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2893797859.00000000027DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1625089311.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2893797859.0000000002791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	19:29:01
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe"
Imagebase:	0x400000
File size:	269'312 bytes
MD5 hash:	DD1BD551108F3EC1E9E775C7B09A0E1C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1739937195.0000000000714000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000001.00000002.1833189225.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000001.00000002.1833499854.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1831905265.00000000021FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1832183101.000000000258F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1833007335.0000000003545000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1832183101.0000000002541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:29:10
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe"
Imagebase:	0x400000
File size:	269'312 bytes
MD5 hash:	DD1BD551108F3EC1E9E775C7B09A0E1C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2894238732.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2892950015.000000000224F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2893613189.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000003.00000002.2893524196.0000000002560000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2893613189.000000000260F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000003.1819413806.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000003.00000002.2894541056.0000000004B20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exePID: 7416, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	43.6%
Signature Coverage:	17%
Total number of Nodes:	289
Total number of Limit Nodes:	33

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

", xrefs: 00401B0F
5, xrefs: 00402109
8, xrefs: 00401BA9
x, xrefs: 00401E69
V, xrefs: 00401E19
W, xrefs: 00401B14
W, xrefs: 00402033
[, xrefs: 00402047
x, xrefs: 00401B78
D, xrefs: 00401DFB
W, xrefs: 00401B23
!, xrefs: 0040201A
v, xrefs: 0040206A
{, xrefs: 0040205B
x, xrefs: 00402088
v, xrefs: 00401B5A
:, xrefs: 00401B28
W, xrefs: 004020E6
h, xrefs: 00401A6F
., xrefs: 0040201F
*, xrefs: 00401A1F
_._, xrefs: 00402257
6, xrefs: 004020C5
%, xrefs: 004020FA
v, xrefs: 00401E4B
), xrefs: 0040202E
{, xrefs: 0040211D
!, xrefs: 00401B1E
v, xrefs: 0040212C
x, xrefs: 0040214A
4, xrefs: 00402136
{, xrefs: 00401E3C
', xrefs: 00401AF6
[, xrefs: 00401B37
0, xrefs: 00401BBD
o, xrefs: 00402159
., xrefs: 00401B0A
V, xrefs: 00402038
E, xrefs: 00401E0F
o, xrefs: 00401B8D
', xrefs: 00402006
___, xrefs: 0040227D
U, xrefs: 004020F5
*, xrefs: 004020E1
o, xrefs: 00402097
4, xrefs: 00401B64
{, xrefs: 00401B4B
!, xrefs: 004020CF
4, xrefs: 00402074

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: 224088bd6fdf40f00aacdd5f7db7c03047c3cc993abb63ba2c7175de51848a6e
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 224088bd6fdf40f00aacdd5f7db7c03047c3cc993abb63ba2c7175de51848a6e
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 0277C418 Relevance: 8.0, Strings: 6, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0277CB70
$kq, xrefs: 0277CB17
$kq, xrefs: 0277CB23
$kq, xrefs: 0277CB64
$kq, xrefs: 0277CB40
$kq, xrefs: 0277CB4C

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 3e8e59e80cbf39e83b9d481c78afa0e3fe479c3ebdf2e69c2b9cac5dc6cab2ad
Instruction ID: d782cefd312f135e7d8ddddcc66583a98c226a23494ae3a4b2e0e089545aea9d
Opcode Fuzzy Hash: 3e8e59e80cbf39e83b9d481c78afa0e3fe479c3ebdf2e69c2b9cac5dc6cab2ad
Instruction Fuzzy Hash: 12324135E1061A8FCB15EF75C8945ADB7B6FFC9300F24C69AD409A7264EF309985CB90

Function 05B699A9 Relevance: 2.8, Strings: 2, Instructions: 334COMMON

Download Yara Rule

Strings

$kq, xrefs: 05B69AA6
Xoq, xrefs: 05B69ABF

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: Xoq$$kq
API String ID: 0-227003152
Opcode ID: ce7d1153d86ce19887878424383703a7b29c802225177c03efc9b872d354bcd6
Instruction ID: 9dc0f635a4c4d375d85b5d39bb86c665b3ad59481cbf3d744d432f4186748ac8
Opcode Fuzzy Hash: ce7d1153d86ce19887878424383703a7b29c802225177c03efc9b872d354bcd6
Instruction Fuzzy Hash: F6B19031B042188FDB4CEB79996527E7BA7BFC8701B14846DE406EB398DE38DC028795

Function 027758E8 Relevance: 2.7, Instructions: 2747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ffabb890cacbb17edc071dee1a5c3baaaa85059eccb568334e57b6d9f2b2b9
Instruction ID: 81239c314071c055b68009ab2d24f22aa515a56ee43409d25c5a9d99335f2b93
Opcode Fuzzy Hash: 78ffabb890cacbb17edc071dee1a5c3baaaa85059eccb568334e57b6d9f2b2b9
Instruction Fuzzy Hash: 9653F731C10B1A8ACB55EF68C884699F7B1FF99300F11D79AE4587B125FB70AAD4CB81

Function 02778AC8 Relevance: 2.3, Instructions: 2316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1aba00eaf9bbe000f20895445e0182532ad39a4e6f8c15817e50c39abf57a4
Instruction ID: 9d755fc5edee190c5a98cc3eb61c43e4023ec83c29592d583cb91cdecce8fe84
Opcode Fuzzy Hash: 9d1aba00eaf9bbe000f20895445e0182532ad39a4e6f8c15817e50c39abf57a4
Instruction Fuzzy Hash: F0333E31D10B198EDB11DF68C8846ADF7B1FF99300F15D79AE448A7225EB70AAC5CB81

Function 0636DA89 Relevance: 1.9, APIs: 1, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3456dcfe5292e7a0d2d485bb8e8dd4abc03aa711c7b8ff8756969b84240cb53f
Instruction ID: bbbeb851317b0c35ed6920e810dabe92681e2fe111bb16ce26fce0628fb77ad6
Opcode Fuzzy Hash: 3456dcfe5292e7a0d2d485bb8e8dd4abc03aa711c7b8ff8756969b84240cb53f
Instruction Fuzzy Hash: 00E11A30E00209CFDB54DFAAC958BADBBF1BF48304F15C559E405AF2A9DB74A949CB80

Function 0277E6C8 Relevance: 1.8, Strings: 1, Instructions: 592COMMON

Download Yara Rule

Strings

$, xrefs: 0277EA96

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f1333e71392cc16552bb48fe5526f25e5393eae8d20ad95de89c1a2d6a7ded66
Instruction ID: 15454ff6670aa55b4367aca072f434a34a0590936d96827074a1c2843cbb4ec2
Opcode Fuzzy Hash: f1333e71392cc16552bb48fe5526f25e5393eae8d20ad95de89c1a2d6a7ded66
Instruction Fuzzy Hash: AC22E131E002158FDF24DBA4C5807AEBBB6EF85320F2484AAD546EB395DB35EC45CB91

Function 0277B608 Relevance: 1.1, Instructions: 1101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf37ecf3d53ae54d9276c6a1cd3f6d40ac4214451190c943b570135fce7d7c5
Instruction ID: 7d49642ff83b0e5fb535691768d10213d31978965e7e4f6fb58753589557369c
Opcode Fuzzy Hash: cbf37ecf3d53ae54d9276c6a1cd3f6d40ac4214451190c943b570135fce7d7c5
Instruction Fuzzy Hash: 73A26B30A00204CFDB24DF64C598B6DB7B2EF4A319F5588AAE406DB3A5DB75DC86CB50

Function 05B65A90 Relevance: .6, Instructions: 648COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ece9dedf3dd4dea894d7167d2dccb1f7628747a2c4f5cfc038528dba20b360f
Instruction ID: ce3bcbd08069a1dad58ffea7b06420761a4ab8b0e98325f5b95f398f0974cbca
Opcode Fuzzy Hash: 1ece9dedf3dd4dea894d7167d2dccb1f7628747a2c4f5cfc038528dba20b360f
Instruction Fuzzy Hash: DF32AF30B001059FDF24DF68D594AAEB7B3FB89310F6088A9D406D7394DB39EC568B91

Function 05B64AF8 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f304abe620f974c0ed0e7e3bbed733ad86421cbbfcc4e3b26358b5d556a71898
Instruction ID: bc957ed8e25cfc2f04480e8ccec9dcc810349c29601e6f46d3541e908ae1552c
Opcode Fuzzy Hash: f304abe620f974c0ed0e7e3bbed733ad86421cbbfcc4e3b26358b5d556a71898
Instruction Fuzzy Hash: F6225270E006098FDF24DB58C590BBEB7B7FB85310F6488A6E409E7395DA39EC818B51

Function 063678E0 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79dcb5a6c8dbce30a1cc2017d8d09063a4c229bc27f752cafbf0b1ab283736f2
Instruction ID: 33d2b4cedcb5c8d8aa9035e1be3e63ef83e261a8e8534d75ce57d74464e516c1
Opcode Fuzzy Hash: 79dcb5a6c8dbce30a1cc2017d8d09063a4c229bc27f752cafbf0b1ab283736f2
Instruction Fuzzy Hash: 07F18B71A00609CFCB55CF69C8849ADBBF6FF49315F958429E806EB254E730F985CB80

Function 0219D890 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f0a9c73edf04e3f401823bc02367cdcca5b0304f1af674d8a840174cf7100f
Instruction ID: 0a4bff7c3a4399862f156bc73a22feac5c072bbfe9fa86ccbd65ad01c3c74c14
Opcode Fuzzy Hash: b2f0a9c73edf04e3f401823bc02367cdcca5b0304f1af674d8a840174cf7100f
Instruction Fuzzy Hash: 62B15F70E40209CFDF14EFA9E98179DBBF2BF89314F148129D419EB258EB749845CB81

Function 0219CC78 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3532b5847db1b7a5fb728d686f9d52061f9bf47173bd3a62a05483feac4a42c
Instruction ID: c0eb2f9203164243b10fd851acdc4e53dd4a316390e0f8a407f80fe9c4c2bac6
Opcode Fuzzy Hash: c3532b5847db1b7a5fb728d686f9d52061f9bf47173bd3a62a05483feac4a42c
Instruction Fuzzy Hash: 70916CB0E40209DFDF14CFA9C99179DBFF2AF8C314F24812AE455AB294EB749945CB81

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 05B6ED31 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05B6EDBE
GetCurrentThread.KERNEL32 ref: 05B6EDFB
GetCurrentProcess.KERNEL32 ref: 05B6EE38
GetCurrentThreadId.KERNEL32 ref: 05B6EE91

Strings

vy, xrefs: 05B6EEBD

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: Current$ProcessThread
String ID: vy
API String ID: 2063062207-2544928794
Opcode ID: b939e361d51b08b61abda747d11a8c4f1b55d09af280f2852ec8c157a640875c
Instruction ID: 66f5dce66f1de87167834357b9380d4155a46642f7808de9248c240ca4678b34
Opcode Fuzzy Hash: b939e361d51b08b61abda747d11a8c4f1b55d09af280f2852ec8c157a640875c
Instruction Fuzzy Hash: E45135B59003498FDB54CFA9D54879EBBF5EF48304F208499E059AB3A0CB34A984CF65

Function 05B6ED40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05B6EDBE
GetCurrentThread.KERNEL32 ref: 05B6EDFB
GetCurrentProcess.KERNEL32 ref: 05B6EE38
GetCurrentThreadId.KERNEL32 ref: 05B6EE91

Strings

vy, xrefs: 05B6EEBD

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: Current$ProcessThread
String ID: vy
API String ID: 2063062207-2544928794
Opcode ID: d3407f2228b5a1b38f404d62bb9eb7fc13a92899ab33d8aef4dbdcf6f1b8cb93
Instruction ID: 2f4e7399c4ff98aad9495df0c52401667279a1337bb774d9bf18ec8e6518f7d3
Opcode Fuzzy Hash: d3407f2228b5a1b38f404d62bb9eb7fc13a92899ab33d8aef4dbdcf6f1b8cb93
Instruction Fuzzy Hash: 2A5155B59002098FDB54DFA9D548BDEBBF5EF88314F20C499E019A73A0DB34A984CF65

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 063671F8 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0636745E

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 421cb9d6b32d9b5cc29510ae6859e5debc122a26c287a1da18ac73d396f9b864
Instruction ID: 06c852c71cbe1cfc9406e25e655e66ccbb181cb6420a3d35eb8dc2bdc77e90e5
Opcode Fuzzy Hash: 421cb9d6b32d9b5cc29510ae6859e5debc122a26c287a1da18ac73d396f9b864
Instruction Fuzzy Hash: 59815470A00B018FDBA4CF2AD44579ABBF5BF48304F008A2EE486DBB54D775E949CB91

Function 05B69E40 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3a8ab5b1cf13de0cd1d1eb529cbdba25d262ee3310e11ca82a8e59342db648
Instruction ID: 2a8456bd93dc6b3b36a727bb6f7cf79de3fdb217c31c12c1bca604741cf410f2
Opcode Fuzzy Hash: fd3a8ab5b1cf13de0cd1d1eb529cbdba25d262ee3310e11ca82a8e59342db648
Instruction Fuzzy Hash: 70412272E047558FCB04DFA9D8043AEBBF1AF89310F1485AAD408EB291DB78A844CB91

Function 06368A64 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06368B82

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6c557767c8d49b142cf77cbb39dd6d3dd75227619ec3534118281bd7e19844d3
Instruction ID: 7d38e9d22a56b22144a730312f040aadf5d74fc7cdc7b00f1698b2fffa7a5ffc
Opcode Fuzzy Hash: 6c557767c8d49b142cf77cbb39dd6d3dd75227619ec3534118281bd7e19844d3
Instruction Fuzzy Hash: 8351DEB1D00359DFDB14CF9AC984ADEBBB5FF48310F24822AE818AB254D7709985CF90

Function 06368A70 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06368B82

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 81fe26b10e7ac2d5c51da91ce0f84d847d963b3d4f96caef813b9d32bb9e5215
Instruction ID: a58811e2424e3b45b67d783fe65fe4029582e8107a3bcf1a518acaa5e09c3e4c
Opcode Fuzzy Hash: 81fe26b10e7ac2d5c51da91ce0f84d847d963b3d4f96caef813b9d32bb9e5215
Instruction Fuzzy Hash: DC41CEB1D003199FDB14CF9AC984ADEBBF5FF48310F24812AE818AB254D7709985CF90

Function 0636B1DE Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0636B271

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5e91fde319d2dcb1279d56dd7d9a82ef0bed04c68fdae130c2517f0e2f90529e
Instruction ID: 699fb5110b52448b106980b442a69a41cebc90350cf31f3640e98799b153448a
Opcode Fuzzy Hash: 5e91fde319d2dcb1279d56dd7d9a82ef0bed04c68fdae130c2517f0e2f90529e
Instruction Fuzzy Hash: 233137B8A00605CFDB54CF96C448AAEFBF5FB89314F24C458E119AB365C730A845CFA0

Function 05B6EF80 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05B6F00F

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e9769ba9c1ee8c42a7795d0629e9484f20484a9a851b8e67c1141dd2483db982
Instruction ID: a23d05d33f9b1d6b76de5d4557d8fb4cb073775d758ee003be4eb0aa9a7faf51
Opcode Fuzzy Hash: e9769ba9c1ee8c42a7795d0629e9484f20484a9a851b8e67c1141dd2483db982
Instruction Fuzzy Hash: 282114B5D002089FDB10CFA9D984AEEBBF8FF08320F14845AE964A3350D378A940CF64

Function 05B6EF88 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05B6F00F

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2acdf43f10ab35450c8e92a42f240e87926abd2861527aa11eeba8ec73a83b58
Instruction ID: 2521660f81ff4f658631c5c2942116d77e390d5fcdc6ea9ed43dde2ce39520b0
Opcode Fuzzy Hash: 2acdf43f10ab35450c8e92a42f240e87926abd2861527aa11eeba8ec73a83b58
Instruction Fuzzy Hash: 9321F5B59002099FDB10CF9AD984AEEFFF8FB48310F14805AE914A7310D378A940CFA4

Function 0277141A Relevance: 1.6, APIs: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02771490

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 5f3c93519be5500a78188a65cbfbac3e39f020edf3f4db61bdb797acae792e2a
Instruction ID: 9044a4578c17911f0b17350e083485aea82c5db616e0b3955245a9afb804e83a
Opcode Fuzzy Hash: 5f3c93519be5500a78188a65cbfbac3e39f020edf3f4db61bdb797acae792e2a
Instruction Fuzzy Hash: 152122B1C0065A9BCB14CF9AC544BEEFBF0EF48320F15816AD858A7650D378AA44CFA5

Function 02771420 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02771490

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c25ab00324452a94770dd5e63af6a2d9d61ed76078c4a700d77dca5ecb408939
Instruction ID: 14400e1ab38f4dc868f0269b9ca717d329cd2c7fa9b9528da1990fd21cb35a14
Opcode Fuzzy Hash: c25ab00324452a94770dd5e63af6a2d9d61ed76078c4a700d77dca5ecb408939
Instruction Fuzzy Hash: 8A1133B1C0061A9BCB10CF9AC544BAEFBF4EF48320F11816AD858A7650D338AA40CFA5

Function 02199200 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02199274

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 43ad2708eb8c088f3ce6e3e0dceac592c8b1720cd5c7f3111200fafc368040c3
Instruction ID: 7ecc8564a95839bb8b59223048ffe72f698af7b72e0c57604422fa2c293aaf63
Opcode Fuzzy Hash: 43ad2708eb8c088f3ce6e3e0dceac592c8b1720cd5c7f3111200fafc368040c3
Instruction Fuzzy Hash: 831106B1D002499FDB10DFAAC584ADEFBF4EF88320F10842AD459A7250C775A944CFA1

Function 06367658 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,063674D9,00000800,00000000,00000000), ref: 063676CA

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 77359fda38a1eb91cade0772f8cf01eeb1025b3698e01128bfad76997991f862
Instruction ID: 3ca49a736a5872b453f6ec5e297a77aadb81f82f87239abc614dce6a4270a9b2
Opcode Fuzzy Hash: 77359fda38a1eb91cade0772f8cf01eeb1025b3698e01128bfad76997991f862
Instruction Fuzzy Hash: 1B1123B6D002098FDB20CFAAC944ADEFBF4EB88314F10842AE429B7210C374A545CFA4

Function 063661D0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,063674D9,00000800,00000000,00000000), ref: 063676CA

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 392e2c1711e7679084fed8377af83bb24a99304b13f6f544993a2afe3ad85f55
Instruction ID: 8aedd3fc4617e8495eca9a46c64e3dc458fd6d3ddee22ec8d4e72dbfbdcfb0cf
Opcode Fuzzy Hash: 392e2c1711e7679084fed8377af83bb24a99304b13f6f544993a2afe3ad85f55
Instruction Fuzzy Hash: 781126B6D002498FDB20CF9AC844ADEFBF4EB88314F50842AE419B7210C374A945CFA5

Function 05B69F28 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05B69F8F

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 72d4fceacfc502c19a8ad8bbd058276fc026536a3e6803179bf0c609c8afe311
Instruction ID: 68c7ce2f8e0fd095751e587e800c994d3a172638ae045ab9d18124622e90a1e6
Opcode Fuzzy Hash: 72d4fceacfc502c19a8ad8bbd058276fc026536a3e6803179bf0c609c8afe311
Instruction Fuzzy Hash: 6711E2B1C0065A9FDB10DF9AC544BDEFBF4AF48320F15816AD818A7250D378A944CFA5

Function 021993D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 0219943A

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b50202b4b1c998965206e1839f9ad4989cef4b55ab21122ed72854027f6b70c0
Instruction ID: 14a8ae5ec5117180492d1d46a9f934df6a3caba446f79ad9e4ca6ac4d8ac7dbd
Opcode Fuzzy Hash: b50202b4b1c998965206e1839f9ad4989cef4b55ab21122ed72854027f6b70c0
Instruction Fuzzy Hash: DD1136B19002498FDB20DFAAC5457DEFBF8EF88324F208429D559A7250CB75A944CFA4

Function 063673F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0636745E

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 20e8c760e3aa3ed7e725657a2a09f1696dd2a34e897770867558837b8597f0c0
Instruction ID: c3f380eabf1867fabbe9d8c55a879df5fb2d5641da152ceadad266503e3e7ac8
Opcode Fuzzy Hash: 20e8c760e3aa3ed7e725657a2a09f1696dd2a34e897770867558837b8597f0c0
Instruction Fuzzy Hash: 0311E0B5C006498FDB10CF9AD448ADEFBF4EF88328F10C46AD469A7614C3B5A545CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0060D5E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891753768.000000000060D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60d000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f9daff34ef838fbc32b81789fe35a853e54662535fb6d6ec16f7badab521d7
Instruction ID: e505800b300037685c56951ecd5b634a458a8193e6ffe2995f6f3cef624b6239
Opcode Fuzzy Hash: 02f9daff34ef838fbc32b81789fe35a853e54662535fb6d6ec16f7badab521d7
Instruction Fuzzy Hash: E7212871590204DFCB09DF94D9C4B27BF66FB94314F248669E80D0B396C337D856CAA1

Function 0072D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891955220.000000000072D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0072D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3473e64b7571910cd347559b16da389b29abbf7575792bd28a0a289aa6877783
Instruction ID: 3aa3abfb71ac1c598d79a8f82b895e38494b5ac459d10a7fc193cbdaf9fdc410
Opcode Fuzzy Hash: 3473e64b7571910cd347559b16da389b29abbf7575792bd28a0a289aa6877783
Instruction Fuzzy Hash: C521F2B1504244DFCB34DF14E9C4B26BBA5EB88314F34C669D9494B266C33ADC46CA62

Function 0060D5E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891753768.000000000060D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60d000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: b65a4e2787518f823d8647f391ed55bc3960f440297155d4db51e6e7635c4140
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 8211BE76544280CFCB16CF54D9C4B56BF72FB94324F24C6A9D8090B396C33AD85ACBA2

Function 0072D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891955220.000000000072D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0072D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction ID: ff15eac83f79c5185ece25e3b6984a621d568303c9caa6b388156d05ab8b3706
Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction Fuzzy Hash: 8811BB75504284CFCB21CF14E5C4B15BBA1FB88314F28C6AAD8494B666C33AD84ACB62

Function 0060D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891753768.000000000060D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60d000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efae8c34b11acbf8b2639fabce109c0c9819bc365437e78f7c0653b25ba65673
Instruction ID: a7b80f7f362ad3f28035c8afa0efd6c8f6243b53774397de9590741af258a1c4
Opcode Fuzzy Hash: efae8c34b11acbf8b2639fabce109c0c9819bc365437e78f7c0653b25ba65673
Instruction Fuzzy Hash: 56014C6140E3C09ED7178B258894B92BFB4EF53224F19C1DBD8888F2E3C2699C49C772

Function 0060D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891753768.000000000060D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60d000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db3470612506a2eed7d407c085d8ce7519f8575b084d4024e905108ea8586e7
Instruction ID: c22d9c3037c8f46ec39b7d7d29608f69463573e76ae614d2f0f153375b370265
Opcode Fuzzy Hash: 8db3470612506a2eed7d407c085d8ce7519f8575b084d4024e905108ea8586e7
Instruction Fuzzy Hash: 9401F7714483009AE7144E65C984BA7BFD9DF45324F18C62AEC4E0B2C6C2799C42C6B1

Non-executed Functions

Function 05B609F8 Relevance: 13.0, Strings: 10, Instructions: 470COMMON

Download Yara Rule

Strings

$kq, xrefs: 05B60B19
$kq, xrefs: 05B60AE8
$kq, xrefs: 05B60B25
$kq, xrefs: 05B60F5A
$kq, xrefs: 05B60F44
$kq, xrefs: 05B60AF4
$kq, xrefs: 05B60EA5
$kq, xrefs: 05B60F50
$kq, xrefs: 05B60EB1
$kq, xrefs: 05B60F66

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: 4b9374bf50049f4f3e60d6787a4b93427c9f9d4771786667dcf2fa7ae0e61e3f
Instruction ID: 12e3b2e55aabafd9669e922d6141711e1776090f857aee9cbec43390ed109294
Opcode Fuzzy Hash: 4b9374bf50049f4f3e60d6787a4b93427c9f9d4771786667dcf2fa7ae0e61e3f
Instruction Fuzzy Hash: 84123130A016198FDB24EF65C954A6EB7F7FF89300F2485A9D40AAB354DB35AD85CF80

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 00408C60 Relevance: 4.1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

Strings

@, xrefs: 00409092
PA, xrefs: 00408E3D
@, xrefs: 00408D03

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: @$@$PA
API String ID: 0-3039612711
Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 02190F40 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

4'kq, xrefs: 021910EA

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 4c5f69f814825ba93c6e254cea6f0d71525f6c824f9fe94e3877e5e8e7ba02e6
Instruction ID: 7e1791666bd28777618fa68421e6f56fc57bb21a7886d7ca9888985ad57150c7
Opcode Fuzzy Hash: 4c5f69f814825ba93c6e254cea6f0d71525f6c824f9fe94e3877e5e8e7ba02e6
Instruction Fuzzy Hash: 3AA10BB1D453914FD706DF39986029ABFB7AF86304F08C6ABC0449F2AADB35590BC760

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 02190FD0 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

4'kq, xrefs: 021910EA

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: aa52ca0ef5fb7442439ebd306b422c62cc14399b82bded5e7bd18038ca629455
Instruction ID: a336197ce03810ae9336aa8420333ad2e244046aae33dda99218a41f45d30303
Opcode Fuzzy Hash: aa52ca0ef5fb7442439ebd306b422c62cc14399b82bded5e7bd18038ca629455
Instruction Fuzzy Hash: 207154B1D452554FD70ADF3AE96069ABFB7BFC5300F14C66BC0049B2A9DB34590ACB60

Function 02191030 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

4'kq, xrefs: 021910EA

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: fa9723c1a09db5e65b6625b8b0838f332cdcbcd2682a3ba3c6511e25368481c2
Instruction ID: b325cd5d79c1a4ba7ce092d9956cfeb0cb504bcbf3cc9b2aa58fb0e23c1c11ea
Opcode Fuzzy Hash: fa9723c1a09db5e65b6625b8b0838f332cdcbcd2682a3ba3c6511e25368481c2
Instruction Fuzzy Hash: 665121B0E402158FD749EF7AE99065ABBE7BBC9300F14C63AD0049B36DDF7469068B60

Function 00407C3F Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95

Function 004073A0 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction ID: 17d22deff8d32e931318445bbea846c6b698fa6fcc44f6923348d96d7e24b863
Opcode Fuzzy Hash: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction Fuzzy Hash: 0A329E70A087029FD318CF29C98472AB7E1BF84304F148A3EE89567781D779E955CBDA

Function 00406CA0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55

Function 05B67F58 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895022699.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b60000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6828f98be5290e6431fdf09777c36505a4471724854eaa1362c72fc01872f794
Instruction ID: 0afcd026faa9f1733b230ae9759efbe1a6257a387044bb39a5fd00556ae13309
Opcode Fuzzy Hash: 6828f98be5290e6431fdf09777c36505a4471724854eaa1362c72fc01872f794
Instruction Fuzzy Hash: 76C19330B001158FDB24DB68D554BBEB7E7FB89310F2488A9E405DB395DB79EC828B91

Function 02770040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957d27ea8d8dd2410ec4898eb79675fcb5a243985ef1bfe6a77b9ba74ed5236c
Instruction ID: b8960d7503e3ccc70b92f7bf912f821aacd9b1890479aef52d5d8654e259746a
Opcode Fuzzy Hash: 957d27ea8d8dd2410ec4898eb79675fcb5a243985ef1bfe6a77b9ba74ed5236c
Instruction Fuzzy Hash: F112A6F0C917468BE710CF25E9EC2893BB9BB41318FD04A0BD2615B2E9D7B4156ACF64

Function 0219CFC0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892569472.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1533d5dff8b01d26c0ed819917314c60653f42e24a8b64509acdd60343b0118
Instruction ID: 567e8a736cc929a9f948f87dc09651a5ae13cad9761cafb50b63824d88866907
Opcode Fuzzy Hash: e1533d5dff8b01d26c0ed819917314c60653f42e24a8b64509acdd60343b0118
Instruction Fuzzy Hash: 27B16EB1E40209CFDF14DFA9E9857AEBBF2AF88304F148129D815AB254EB749945CF81

Function 06366078 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895417136.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b0ea57a24b7f1d0f6acd81294757ab532d2d3d0e3d3910797407d9f18e29c6
Instruction ID: c30befa4fe66768d4e72a1e1fbba65dee8a81114f385d7850deb8fe07ed5d627
Opcode Fuzzy Hash: 84b0ea57a24b7f1d0f6acd81294757ab532d2d3d0e3d3910797407d9f18e29c6
Instruction Fuzzy Hash: 15A18E32E10619CFCF45DFA6C84159EBBB2FF86300B15856AF806AB215DB31E955CBC0

Function 02770007 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2893730512.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debd3f3eb0a60f19f825dba6e8a89fa18aa51daafdc7c41ad64dd8444814e7a5
Instruction ID: 9e0491efd22174b6b298cca98606a7b1323e86c6c39e4902de0ea0a982bc904f
Opcode Fuzzy Hash: debd3f3eb0a60f19f825dba6e8a89fa18aa51daafdc7c41ad64dd8444814e7a5
Instruction Fuzzy Hash: A6D14AF0C817468BD710CF25E8EC1897BB9BB85314F944B0BD1606B2E9DBB414AACF64

Function 00402B90 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction ID: 74c1b90a01db230de662c72faab58802bb742d928f34651097fec506a9751401
Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction Fuzzy Hash: 15717072A9155347E39CCF5CECD17763713DBC5351F49C23ACA025B6EAC938A922C688

Function 004028B0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC

Function 00401650 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77

Function 00402F20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction ID: cff114a85fcb8f5deb46d81d22c4208fa3965af46b01a687ebeadebabb5a60ab
Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction Fuzzy Hash: 9A31D8302052028BE738CE19C954BEBB3B5AFC0349F44883ED986A73C4DABDD945D795

Function 00402F89 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction ID: 40597224e526abc728bb10992f322fa75c91b34d76fbbe6bc80328d1c420bfc2
Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction Fuzzy Hash: F321923170520247EB68C929C9547ABB3A5ABC0389F48853EC986A73C8DAB9E941D785

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,021E1900), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b820e78b463918eed32479816903fc70d8532b7c557c67349a3712e4f0fad1ae
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b820e78b463918eed32479816903fc70d8532b7c557c67349a3712e4f0fad1ae
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 61b9ef8a6f765c58139a33a573ef994292dae8fcc9e916c915b81b6d9ebba236
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: 61b9ef8a6f765c58139a33a573ef994292dae8fcc9e916c915b81b6d9ebba236
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 0040C73D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Strings

'B, xrefs: 0040C70F

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID: 'B
API String ID: 2805327698-2787509829
Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(021E1660), ref: 00414050

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 0040FA58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040FA7A
__calloc_crt.LIBCMT ref: 0040FA93

Strings

`$B, xrefs: 0040FACC
P$B, xrefs: 0040FAAA

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: 4bdca0f49684ef71ac3198dcc3f656e5d5ce7fed137673697bf40858e87bd1f9
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 6011A3327446115BE7348B1DBD50F662391EB84728BA4423BE619EA7E0E77CD8864A4C

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 004146FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 0041470C

Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(00000001), ref: 004145E4
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 004145F1
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 004145FE
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 0041460B
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414618
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414634
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414644
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 0041465A

___removelocaleref.LIBCMT ref: 00414717

Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 0041467B
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 00414688
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 00414695
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146A2
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146AF
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146CB
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(00000000), ref: 004146DB
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146F1

___freetlocinfo.LIBCMT ref: 0041472B

Part of subcall function 00414489: ___free_lconv_mon.LIBCMT ref: 004144CF
Part of subcall function 00414489: ___free_lconv_num.LIBCMT ref: 004144F0
Part of subcall function 00414489: ___free_lc_time.LIBCMT ref: 00414575

Strings

@.B, xrefs: 00414722

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B
API String ID: 467427115-470711618
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: 8e9b8205a585dc9325c25650a27042e0212317e7447dcce9b0fe23aa5a8dd77f
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: BDE0863250192255CE35261D76806EF93A98FD3725B3A017FF864AF7D8EB2C4CC0809D

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 689e5a2a8d0df6628a55ca55f65915ee6a0b33bdec45a2b9390eeacb6c5b01b1
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 689e5a2a8d0df6628a55ca55f65915ee6a0b33bdec45a2b9390eeacb6c5b01b1
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000000.00000002.2891267853.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2891234724.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891315681.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2891353782.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Analysis Process: fMNDB.exePID: 7616, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	92.1%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	5

Executed Functions

Function 05B3C2C0 Relevance: 8.0, Strings: 6, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 05B3C9F4
$kq, xrefs: 05B3C9BF
$kq, xrefs: 05B3CA18
$kq, xrefs: 05B3C9CB
$kq, xrefs: 05B3C9E8
$kq, xrefs: 05B3CA0C

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 436f92a033850937c99e1c127621c5abf0d35d91b19b498e668fc7ab3bbdd303
Instruction ID: 6ed8a47d502b48510082e391cec3ece68e7216ff898f441f4c7b7a7393cfe6c0
Opcode Fuzzy Hash: 436f92a033850937c99e1c127621c5abf0d35d91b19b498e668fc7ab3bbdd303
Instruction Fuzzy Hash: 34321135E1061A8BCB14EFB5D99459EB7B2FF89300F209699D409B7264EF30AD85CB90

Function 05B352C8 Relevance: 2.8, Instructions: 2818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31d0c37dad169b5aade4f829ed49317943db26cc1cb5d0ff9169a618f023095
Instruction ID: 7cab344f198c8a5fc2fce6f6ab5d1348c0767a03a16bea0a7c8ae04b572316b9
Opcode Fuzzy Hash: a31d0c37dad169b5aade4f829ed49317943db26cc1cb5d0ff9169a618f023095
Instruction Fuzzy Hash: 0D53E731D10B1A8ACB51EF68C8845A9F7B1FF99300F51D79AE4587B125EF70AAC4CB81

Function 05B3E598 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 05B3E966

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 0e70ef24790355944c376ca00a93c7d7f385f1cb6c26214d2900aa61e8d907fb
Instruction ID: c1772829f0031ccb9d6365e11155d76778d42908d469270397c6aabedf5273fe
Opcode Fuzzy Hash: 0e70ef24790355944c376ca00a93c7d7f385f1cb6c26214d2900aa61e8d907fb
Instruction Fuzzy Hash: DE229175E002199FDF24DB64C581AAEBBB6FF84310F2485AAD406BB394DB35EC45CB90

Function 05B3DB40 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fpq, xrefs: 05B3E24D
XPpq, xrefs: 05B3DC6D
\Opq, xrefs: 05B3DCF7

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: bd9e1dae6ef2c91ccd0bbc1eb757bd223a4e3932eb76a7f7e0519b7b89cb11c2
Instruction ID: 9b72fa68e8804346554c7060d1b0ae48cab78f3782989342443d8293bd4c3bce
Opcode Fuzzy Hash: bd9e1dae6ef2c91ccd0bbc1eb757bd223a4e3932eb76a7f7e0519b7b89cb11c2
Instruction Fuzzy Hash: C2618E71B002099FDF149FA8C955BAEBAF6FF88740F208069E506AB3A4DF759C418B54

Function 05B69E40 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1834107447.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b60000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142c4aa1ff5b6c75e3df579fbbb6acc065592afb7e1481c5aba65166c1c71b9c
Instruction ID: d7abc11f9ce1c65753e9061d4088774103196859a04f6798ad62723e80fe2b81
Opcode Fuzzy Hash: 142c4aa1ff5b6c75e3df579fbbb6acc065592afb7e1481c5aba65166c1c71b9c
Instruction Fuzzy Hash: 4D4123B2E047958FC700CFA9D40439EBBF1EF99310F1985AAD444E7251DB38A845CBD1

Function 020B9200 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 020B9274

Memory Dump Source

Source File: 00000001.00000002.1831816769.00000000020B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20b0000_fMNDB.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2831f9c55f57e0ffc77adf3d244d78fc52a0949be9b3c23ce78e1b17da168b10
Instruction ID: fff6257cf4810c86eef96decc605adb6b221b56ff1307838ced3d7ecb2e23e5e
Opcode Fuzzy Hash: 2831f9c55f57e0ffc77adf3d244d78fc52a0949be9b3c23ce78e1b17da168b10
Instruction Fuzzy Hash: 4011F4B1D003499FDB10DFAAC584ADEFBF4EF48324F10842AD559A7250CB75A944CFA5

Function 05B69F28 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05B69F8F

Memory Dump Source

Source File: 00000001.00000002.1834107447.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b60000_fMNDB.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 54965697bce194151f86b69072964e84fbcb89f74e5ba6ede6c9978716ecd6ca
Instruction ID: a5947e06e9c5a8835590924cfa1c98f39590485200a5321956058fc8fe0f2876
Opcode Fuzzy Hash: 54965697bce194151f86b69072964e84fbcb89f74e5ba6ede6c9978716ecd6ca
Instruction Fuzzy Hash: F511E2B1C0065A9FCB10DF9AC544BDEFBF4AB48324F15816AD818A7250D778A944CFA5

Function 020B93D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 020B943A

Memory Dump Source

Source File: 00000001.00000002.1831816769.00000000020B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20b0000_fMNDB.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8f3cf767e7815e8fa3dcfef74890b7d0e1bac3a56c3fe86d4f65c02cb1486106
Instruction ID: 67dddfe18fd6b10661913feba6a863762076b5249650a91c40201ddb5506eb3c
Opcode Fuzzy Hash: 8f3cf767e7815e8fa3dcfef74890b7d0e1bac3a56c3fe86d4f65c02cb1486106
Instruction Fuzzy Hash: 401128B19003488BCB20DFAAC5457DEFBF4AF88324F208429D559A7250CB74A944CF95

Function 05B3DB30 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

XPpq, xrefs: 05B3DC6D

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: 1a75417fc80ee0576de425cf777c0e42338aed3e3d92ca52463de5bebb27fa10
Instruction ID: 79b76fe1d99dcb861e72378c60a33a5025de0ec04db569b40a026da96fbed94d
Opcode Fuzzy Hash: 1a75417fc80ee0576de425cf777c0e42338aed3e3d92ca52463de5bebb27fa10
Instruction Fuzzy Hash: E2418F71F102099FDB44DFA8C914BAEBAF6FF88740F208529D106AB3A8DA759C41DB50

Function 05B3AF31 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

PHkq, xrefs: 05B3B07B

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 98a9ff0e4e3a6bc14bceee5aada02ef4be54694a3f3a7b8a53673e294f02191f
Instruction ID: 7594308baef65dddc14080fd5c9397a9f11031b60a5e37476b4fb50150793cb4
Opcode Fuzzy Hash: 98a9ff0e4e3a6bc14bceee5aada02ef4be54694a3f3a7b8a53673e294f02191f
Instruction Fuzzy Hash: 1231E435B002058FCB159B34D65566E77A7FF88600F2448ACE40AEB399EF35EC41C795

Function 05B31390 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LRkq, xrefs: 05B313D5

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 2a29820b62b68176a815d3de3ec727c95f5ed8d84cfc263fa3a393c271524ed5
Instruction ID: e1d0f64618bbee8c49f3ef09697b7d6c7be9f8f3b5ea5513a9a974427ec84b22
Opcode Fuzzy Hash: 2a29820b62b68176a815d3de3ec727c95f5ed8d84cfc263fa3a393c271524ed5
Instruction Fuzzy Hash: 95317030E10219DBDF14CFA8C546BAEB7BAFF45304F108569E406FB250EB74A946CB51

Function 05B3AF08 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

PHkq, xrefs: 05B3B07B

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 34cefd1607238fa0c5d0a3a945b0a7ba7f4677c254c648587a4760e0bf3cca86
Instruction ID: ce39c0abe4464f3cd80c09c2e09ad35218c23aedcd2f7eb07026b80b1a26b52c
Opcode Fuzzy Hash: 34cefd1607238fa0c5d0a3a945b0a7ba7f4677c254c648587a4760e0bf3cca86
Instruction Fuzzy Hash: 0531E235B042458FCB169B349A5422E7BB7BF86240B2444EDD04AEB3AEDF39DC45C791

Function 05B31380 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

LRkq, xrefs: 05B313D5

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 41a0112ffaf201e8eae9e8e7b0b89ed773a89f1305c97a84e2951c949adfcc6f
Instruction ID: d32b7722145294e6738eb526061488c6eb15ef7b9f30df66f47082bb68b15a72
Opcode Fuzzy Hash: 41a0112ffaf201e8eae9e8e7b0b89ed773a89f1305c97a84e2951c949adfcc6f
Instruction Fuzzy Hash: 4D314131E102199BDF14CFA8C951BAEB7BAFF45300F618569E801FB250EB74E946CB50

Function 05B30D00 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

LRkq, xrefs: 05B30D27

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 518d80a397a677f8176ad20e99360c19880b58932793df60ec6e0bc69505a987
Instruction ID: 81c00508455c4cc8d03b88c9adcaf148f03c22384c36786feaca4cf8de464e2e
Opcode Fuzzy Hash: 518d80a397a677f8176ad20e99360c19880b58932793df60ec6e0bc69505a987
Instruction Fuzzy Hash: 5911F0717002168BCB18EB69E815BAE76E2FF89640F008869D005CB3A8DF35A84587D5

Function 05B30CEB Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

LRkq, xrefs: 05B30D27

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: ecabe542ec624ace4c1195a04b4d33913c97bcaa1cb68f6547124577e67f671a
Instruction ID: 17fc0a607dcd02215979fd67805789e740b453f612e75220ea54ecbc00ccc99d
Opcode Fuzzy Hash: ecabe542ec624ace4c1195a04b4d33913c97bcaa1cb68f6547124577e67f671a
Instruction Fuzzy Hash: 6101F272B002118FCB05EB78D9553AE7BF2EF8A750F1084AED00ACB7A5DE359C418791

Function 05B31D43 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db89eb27ec4074fc74febb952a7193b855ba5b98f070f529b2bee04894a49b43
Instruction ID: c5a20c4ae1621a4f0574a12a0b5aab36d66f8c57544e5e3e284c438f33a02fa8
Opcode Fuzzy Hash: db89eb27ec4074fc74febb952a7193b855ba5b98f070f529b2bee04894a49b43
Instruction Fuzzy Hash: 5002FE35B103018BDF192778A45963C39A7FBCE755B68446DE806DB380CE3ADC839B5A

Function 05B34AE0 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465f421e2cb40dedae709023476bf9674372aef8738a024f3ae1e76819bdb4be
Instruction ID: 4151cb2f5fada5f80b58ba73047b57b2527cbcae7f829f42572480b8ce825c5c
Opcode Fuzzy Hash: 465f421e2cb40dedae709023476bf9674372aef8738a024f3ae1e76819bdb4be
Instruction Fuzzy Hash: 11E14F34B002059FCF14DB68D599A6EBBB6FB89310F1444A9E40AE73A4DB35EC46CB90

Function 05B38568 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751b1308317630bc5ec5e4855bf7ce54bdf2bb8470ad57859c3abfccd39fd7a7
Instruction ID: 083d29d68df03a26792e27a857ad87aca239e6d4bba96796aec7e23f78869395
Opcode Fuzzy Hash: 751b1308317630bc5ec5e4855bf7ce54bdf2bb8470ad57859c3abfccd39fd7a7
Instruction Fuzzy Hash: B7C1E471B012129FDB15CB68C940A7EBBA7FF84310F2585A9E415EB3A9DB31EC42C791

Function 05B34AD2 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbc143ebdc12af2c84cc78b0537a29b7d57e890c7fe6e383255d9126c2455e7
Instruction ID: 74b2d1d6dcf550ab94cd97d8bd9661c34553c7f8c6bc04bff5a040e0bd191b4f
Opcode Fuzzy Hash: bbbc143ebdc12af2c84cc78b0537a29b7d57e890c7fe6e383255d9126c2455e7
Instruction Fuzzy Hash: BF911B35A102159FCF14DB64D58AAADBBF6FB88310F1484A9E806E73A4DB31EC46CB54

Function 05B3F1C8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3615c846b59ed84b226d4dd2eab2188cb14557404380e87e124cec3a2ffc42fa
Instruction ID: 90a7ea54c23768a83d45758c525fe14dbb2f15026bd38d18748aafa8315546ca
Opcode Fuzzy Hash: 3615c846b59ed84b226d4dd2eab2188cb14557404380e87e124cec3a2ffc42fa
Instruction Fuzzy Hash: 6061C5B5F001214BCF149A7DD844A7EBADBEFD4610B254076F80AE7365DE69EC0287C5

Function 05B35030 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455eb57da0220e89b4e15894759740dafa71f9b43e3d6d99b33073ca73b8daaa
Instruction ID: 178847d68bb14564abcaa854a7768057b7b1ed5ddd8f106f8af96c2d830315c1
Opcode Fuzzy Hash: 455eb57da0220e89b4e15894759740dafa71f9b43e3d6d99b33073ca73b8daaa
Instruction Fuzzy Hash: 4C81A071A002058FDB14DF68D985B9DBBB2FF88310F14C1A9E909AB395EB71E845CB90

Function 05B3D121 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d873ca9ffa4e6e88b93a504d768c50520989dbd2a5a11783092e9a5dfbb2fe
Instruction ID: 78b34082a1c0f3c1b976cc63f8a297ed4f5d576ca200532fa352c9821494279b
Opcode Fuzzy Hash: 78d873ca9ffa4e6e88b93a504d768c50520989dbd2a5a11783092e9a5dfbb2fe
Instruction Fuzzy Hash: BC812B34B0060A8FDF54DBA9D555A6E77B7FB84340F208469D40AEB398EB74EC428B91

Function 05B3D460 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5db3fd0dac4b2e29f6f7b582d712463b9e6b20103a996224616e5ffb11195a
Instruction ID: 32caa7de79813e2885761f63879b4cd4155bea1eb666c961fb075416494663c9
Opcode Fuzzy Hash: fb5db3fd0dac4b2e29f6f7b582d712463b9e6b20103a996224616e5ffb11195a
Instruction Fuzzy Hash: B6615171E103098FDF10DBA8C951BEDB7B2FF89310F208529E519BB294DB74A985CB81

Function 05B3D470 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18a2ccef812539d752f78687107912ee6055e2f46b5effe2fc2ab6a9a23d34b
Instruction ID: 028081f4483ef467c39650b455a70a73ac8044cc99708c54f88b00d22327a414
Opcode Fuzzy Hash: c18a2ccef812539d752f78687107912ee6055e2f46b5effe2fc2ab6a9a23d34b
Instruction Fuzzy Hash: 01614130E103098FDF10DBA8C951BEDB7B2FF89310F208569E519BB294DB74A985CB81

Function 05B34E50 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc0500d6e20301a3ce98fcb1da2baa30f1a1d1778215f0c2d54bb96d1df5756
Instruction ID: 8cbc99ad43967648f296107276c156c7be9a740dd36ac6d83213c45338ed5f65
Opcode Fuzzy Hash: fdc0500d6e20301a3ce98fcb1da2baa30f1a1d1778215f0c2d54bb96d1df5756
Instruction Fuzzy Hash: DB41AF35F001168BDF24DA68DA85B7EB7A6FB85310F20486AE40EE7294D735EC458B81

Function 05B30E2C Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4686885e49a11f73442c69ab10af9a1901223043c874501a331c29dd026bbe
Instruction ID: fef6d2bc1ac0a3076fc1c0aea422c6d860d722c678ac109e84111a5c003808b2
Opcode Fuzzy Hash: 4e4686885e49a11f73442c69ab10af9a1901223043c874501a331c29dd026bbe
Instruction Fuzzy Hash: 485101B1E002188FDB14DFA9C889B9DBBF1FF48310F148169E819BB3A4D774A944CB95

Function 05B30E38 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad5618b3c98b0501a5d300c2e48d81772b43cda08c8fc93141fd9c82d6a86e
Instruction ID: 5d1bed9a237c03e577179b16166c3a66582ac532051dece1e1edeb7dc9f96a6b
Opcode Fuzzy Hash: 2aad5618b3c98b0501a5d300c2e48d81772b43cda08c8fc93141fd9c82d6a86e
Instruction Fuzzy Hash: AC51F271E006188FDB14DFA9C889B9DBBF1FF48310F148159E819BB264DB74A944CF95

Function 05B3E412 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa256fcc21699cdc87287bbb222c49ace6d90015d0fd40381396f8a847a63fc4
Instruction ID: cdf956c3d7b8781917fb31b6247576ab69cce42b67305b8d6523195482106257
Opcode Fuzzy Hash: aa256fcc21699cdc87287bbb222c49ace6d90015d0fd40381396f8a847a63fc4
Instruction Fuzzy Hash: CF416D75A006098FDF30CEA9D981ABFFBB6FB88310F10496AE156E7650D330F8458B91

Function 05B3ADA0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab6972b4c6f284af4f9ea45cd04714fc9db4aea483225ccc23f28c035880cec
Instruction ID: 64d5847df37bbdd6ddcae33fa72065acd88745388b19adf0342dd650606798b8
Opcode Fuzzy Hash: 4ab6972b4c6f284af4f9ea45cd04714fc9db4aea483225ccc23f28c035880cec
Instruction Fuzzy Hash: 2C313B31B102168BCF19DF74D556AAEB7B2FF89300F248469E806FB354EF31A9468794

Function 05B3ADB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69755dad5ba58a87ee73ccfde0f1e531c7288ad11bb65951931c8d8a69abb73
Instruction ID: 258e5407e475a3e028f09d93ba30403a5cb43bf12e050b3cac3b3b4ca19dc072
Opcode Fuzzy Hash: f69755dad5ba58a87ee73ccfde0f1e531c7288ad11bb65951931c8d8a69abb73
Instruction Fuzzy Hash: EF313A30B102158BCF19DF64D455AAEB7B6FF89300F208469E806EB354EF31A9468B94

Function 05B34900 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a8e0a648067bfda4d82b1f92585ccf97b07a04b0e9214942ec9688320dcafa
Instruction ID: 5ef0b5a182f1b78f4ade15fc0f6d59802d9930cd30bd4897f43bcab61301d2f3
Opcode Fuzzy Hash: 78a8e0a648067bfda4d82b1f92585ccf97b07a04b0e9214942ec9688320dcafa
Instruction Fuzzy Hash: 75319031E102059FCF05CF64D995AAEBBB2FF85340F108569E801FB350EB70A846CB54

Function 05B34928 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2ab18ae4f6cec520b8f97af16288da6b62f813a72eceb6da722a94af439eec
Instruction ID: 9a8800224e064cdcc8567a90c8a58feb97e5b9a8e17e4ac8673d44fef0505fb7
Opcode Fuzzy Hash: 7d2ab18ae4f6cec520b8f97af16288da6b62f813a72eceb6da722a94af439eec
Instruction Fuzzy Hash: 2A316F30E1020A9FCF19DF64D555AAEBBB6FF89340F108569E801FB354EB71A846CB54

Function 05B3CD30 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a9aeefafa3c5a520b62510926b59911572ef5e9a8398caff1194100e254a3b
Instruction ID: b5b2dea4e4c78d69d3fd0c07dbdc9e3d89a781f68888ebac94f5307c11331f75
Opcode Fuzzy Hash: b1a9aeefafa3c5a520b62510926b59911572ef5e9a8398caff1194100e254a3b
Instruction Fuzzy Hash: 3C215779F516159FDB10DFA9D982AAEBBF1FB88310F104069E905F7258EB30AC418B94

Function 05B3CD20 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3512c3003a3e6f5455bf80c767c10e0b2a91471491f5740fab216655d786a511
Instruction ID: c326dabb3710ff5df4fbd4f72989ed48e9f0ccd332b06abd7a3d84e1590307f4
Opcode Fuzzy Hash: 3512c3003a3e6f5455bf80c767c10e0b2a91471491f5740fab216655d786a511
Instruction Fuzzy Hash: 84214876F502159FDB00DFA8D982AAEBBF1EB48710F008065E905E7398EB30EC418B54

Function 05B347EF Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b002b27bf387a5ee5fee710b89509aee7f77e781ced6999f9b9e75b0d57c336
Instruction ID: 2ad83c27b4593301ef0c694a1e51bb63df5adab197d474bbc55a121f94603bdb
Opcode Fuzzy Hash: 5b002b27bf387a5ee5fee710b89509aee7f77e781ced6999f9b9e75b0d57c336
Instruction Fuzzy Hash: 9921A431E002598BDF19CFA4D555AAEB7B3FF89300F10856AE812F7390EB70A846CB40

Function 01FCD5E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1831511159.0000000001FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1fcd000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35485685adfa2bc6ef4f35cf2a47ae82457b080a691b98545e67380674d43d5a
Instruction ID: 0c6fcad67a01cd37d1149d79ceb6dcdca3b7dd6b5d82cbb5d4f64d393829e5c7
Opcode Fuzzy Hash: 35485685adfa2bc6ef4f35cf2a47ae82457b080a691b98545e67380674d43d5a
Instruction Fuzzy Hash: F3212FB2500201DFCB05DF98CAC0B2ABFA5EB98B14F20817DE80D0B216C336D446EAE1

Function 05B34800 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac38df4d6d35f36edf9a7ce368cae6a51546d28b25295414f920edd1707e377
Instruction ID: 591b8a12eeb87d88ccae82e8231d78dbd57d9da406e285d1be9039132888e77a
Opcode Fuzzy Hash: dac38df4d6d35f36edf9a7ce368cae6a51546d28b25295414f920edd1707e377
Instruction Fuzzy Hash: 68218330E102599BDF19CFA4D5559AEB7B7FF89310F10866AE812F7390EB70A845CB50

Function 05B3C2B0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01652ce1447319e313ec1b02ce2aee0c7a1e556d2861cfdf68c68cb5190afe25
Instruction ID: 2a9e94731bcf9b251f1d8e9819cbbd86bacbe5303f2ef7e9d06331cc6e76d54e
Opcode Fuzzy Hash: 01652ce1447319e313ec1b02ce2aee0c7a1e556d2861cfdf68c68cb5190afe25
Instruction Fuzzy Hash: 0E217271E002159BCF64DBA8D9815DEBBB6FF89310F1485AAE406FB354DA31ED41CBA0

Function 05B3CE48 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebade53086ac51f239af35acb48a4f01b6c9561f6ef359de2be4dd11fc57107
Instruction ID: 2f3ad2f73c26a71e77ac0293f2bd0ed4af6cb4d9992dc53f46e1e7eae4b3401c
Opcode Fuzzy Hash: 8ebade53086ac51f239af35acb48a4f01b6c9561f6ef359de2be4dd11fc57107
Instruction Fuzzy Hash: F2118E31B101244BCF54DAA8C814ABF77EBEBC8710F008579D406F7358EE64EC068B90

Function 01FCD5E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1831511159.0000000001FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1fcd000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 39c6fc471d4565ae062f659cc46cf4e2ab9caf00c2914f70cc7172b3bf0c9819
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 5311E1B2804240CFCB06CF54DAC4B1ABF71FB94314F24C5ADD8090B216C336D45AEBA1

Function 05B3D07F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e6cba9bbbac7b10df6d6cf3863fd28321055f144c5af81ea1bd1736c8b831b
Instruction ID: 68e64052c6875a728c3d25bf53e9eee9d78383a11e7b36c88775487422056b99
Opcode Fuzzy Hash: 37e6cba9bbbac7b10df6d6cf3863fd28321055f144c5af81ea1bd1736c8b831b
Instruction Fuzzy Hash: 8601B1317004110FDB209ABCD951B2AB7E7EBC9B60F20887AE40ACB394E932DC034395

Function 05B3CAF9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782652149a85ba45bef4dc67a8b7633d73407d5ad702f8bab1e6124fee72b93
Instruction ID: d64c822a3fe17b361a2e2d963c38dca86104929f61ec5bfc4a6397a0b13aaac5
Opcode Fuzzy Hash: 9782652149a85ba45bef4dc67a8b7633d73407d5ad702f8bab1e6124fee72b93
Instruction Fuzzy Hash: 2C21C3B5D012599FCB00DF9AD885ACEFFB4FB49320F10812AE918B7240D374A944CBA5

Function 05B3CB00 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988eb882693d7b4d188c7892f87e2f88d39356e37ab28ecfaf0097c1f0ec65af
Instruction ID: e3f74ffeb7f53c6aab884e5fd32c36ec5c355f9bf90a596ee14d023a95426fec
Opcode Fuzzy Hash: 988eb882693d7b4d188c7892f87e2f88d39356e37ab28ecfaf0097c1f0ec65af
Instruction Fuzzy Hash: 5911C0B5D012599BCB00DF9AD884ACEFFB4FB49320F10812AE918B7200D374A944CBA5

Function 05B3D090 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d70486b1a91a6a4be76dd42a625a1a1b3d9e1da303fd289285dc388bf21b93
Instruction ID: 78944d90dd6aafc7404b8ec081e766734f1adc1600a8d97b9d03e5e4d2249810
Opcode Fuzzy Hash: b4d70486b1a91a6a4be76dd42a625a1a1b3d9e1da303fd289285dc388bf21b93
Instruction Fuzzy Hash: 57014B317004110FDB2499BD9956B2AB7EBEBC9B60F20887AE50AD7394ED62EC034395

Function 05B35022 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab702be3a21f1fcc7edd121b6ac9124abf9c099341d161ecb82e28e077c90bc
Instruction ID: db77cea97bb4cc5864d5ccb3c3789d7c1d9510056297ed532b29ae926c7f12e8
Opcode Fuzzy Hash: 9ab702be3a21f1fcc7edd121b6ac9124abf9c099341d161ecb82e28e077c90bc
Instruction Fuzzy Hash: 0D11A131A002048FDB10EF55DD8478ABB66FF81311F54C565C8096F3A9EB71E949CBE1

Function 05B3CE39 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4ff8d971c32d7019a960a034b93d4e7892218d0217779b117037435fd158b9
Instruction ID: 4d45080e45aa57a27810952e9048e59c78d122405203c5201211073ded97d646
Opcode Fuzzy Hash: ca4ff8d971c32d7019a960a034b93d4e7892218d0217779b117037435fd158b9
Instruction Fuzzy Hash: F301DB32B100284BCF589AA8C810AFF36EBEBC8B10F00403AD406F3388EE60EC1247D5

Function 01FCD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1831511159.0000000001FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1fcd000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0489f0f089dd0c34636d06baf90d4a136699128f2601a6043e41a83b688180ec
Instruction ID: 31f3a501ab96a85ab07b11ea734663df36f28884da09888591cde6eca167d60b
Opcode Fuzzy Hash: 0489f0f089dd0c34636d06baf90d4a136699128f2601a6043e41a83b688180ec
Instruction Fuzzy Hash: 1A01F771448301DAE7104A6DCE8476BBFD8DF417A4F08C53DED4C0B14AC27A9845D6F1

Function 01FCD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1831511159.0000000001FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1fcd000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f3179e1e27be2c786f95cf29cd12de7ec2242283d505cefbac52ead08275ae
Instruction ID: 5b63138c0a8463e85457dbd5aa44977d7ad311a9366c6466e6cc8fef1cf4a27f
Opcode Fuzzy Hash: 56f3179e1e27be2c786f95cf29cd12de7ec2242283d505cefbac52ead08275ae
Instruction Fuzzy Hash: C201807140E3C09FD7128B298D94756BFB4EF53224F09C1DBD8888F1A7C2694849C7B2

Function 05B314A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3415baa1fccb673e1252e4a7a9dc7476d9a67ffe7d86c5b052a85f7c245c3596
Instruction ID: 21ca2e11e2250f95e735af4dd42d875722aafa3b1b71a534d5bdbce621adca29
Opcode Fuzzy Hash: 3415baa1fccb673e1252e4a7a9dc7476d9a67ffe7d86c5b052a85f7c245c3596
Instruction Fuzzy Hash: BA011635B00204CFCB15EB68D55AB6C3BB2EF89215F5500A8E1069B2B4DF38AD46CF00

Function 05B32478 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c85bc1b20586e11cad6eb63cfe48f6b9cba9a784d8b44847f49a1228a4096bf
Instruction ID: ed036aed57c943ccecfd9dfe063d76e50088e090bcd663c803bc9d191309ef9c
Opcode Fuzzy Hash: 9c85bc1b20586e11cad6eb63cfe48f6b9cba9a784d8b44847f49a1228a4096bf
Instruction Fuzzy Hash: 4D012C30A40149DFCF04FBA8FA51A9DBBB2EF41348F505A78C0059B278EB319A499B51

Function 05B32488 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba9e8611889a89de7859b434d3acfe24fd4b9334a3280fdc67c61726bf7edfb
Instruction ID: 17c4529c97b2dd566da0db560413f4c0759f0e0ca9d624361d148d7935c43b3e
Opcode Fuzzy Hash: 4ba9e8611889a89de7859b434d3acfe24fd4b9334a3280fdc67c61726bf7edfb
Instruction Fuzzy Hash: 2E016D309401099FCF04FFB8FA4199DBBB6EF41304F504A78C0059B238EB31AA49AB91

Function 05B3F450 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1834087446.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5b30000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf8c7fc3919ac52f1ebb36b96fe90d88e7f9a066fcf784d325e50528e664572
Instruction ID: 082c22b538f63fca6eee50bd09c357a37e1a6225661b47e7ff6a4584a5831318
Opcode Fuzzy Hash: ccf8c7fc3919ac52f1ebb36b96fe90d88e7f9a066fcf784d325e50528e664572
Instruction Fuzzy Hash: CFE04FB2E011096BDF50DEA4C947B7A77AEE705254F6085A4E849E7342E53AEA024391

Analysis Process: fMNDB.exePID: 7796, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	136
Total number of Limit Nodes:	10

Executed Functions

Function 059FC2C0 Relevance: 8.0, Strings: 6, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 059FC9F4
$kq, xrefs: 059FC9BF
$kq, xrefs: 059FC9CB
$kq, xrefs: 059FC9E8
$kq, xrefs: 059FCA18
$kq, xrefs: 059FCA0C

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: c2a386c2a4594aff4e17cfc6d0fa711a4ccc4aaf3ebf02fc48b7b573c502881d
Instruction ID: 0627d32dc35f1d151823992db0c5f9b5f8d79b080e2e6d7a953069cb996cb3c7
Opcode Fuzzy Hash: c2a386c2a4594aff4e17cfc6d0fa711a4ccc4aaf3ebf02fc48b7b573c502881d
Instruction Fuzzy Hash: 14323F31E1061ACBCB14EF74D8945ADB7B6BFC9300F20D69AD509A7264EF30AD85CB90

Function 059F578A Relevance: 2.8, Instructions: 2757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e97cc9616c769a3a573a9915ba15537598f3f4109d6954174d743ae8614be74
Instruction ID: dbc393acc98858996a7343c69f282a6de306bbe560ab2959b525d0c737c88a30
Opcode Fuzzy Hash: 8e97cc9616c769a3a573a9915ba15537598f3f4109d6954174d743ae8614be74
Instruction Fuzzy Hash: 9453F831D10B1A8ACB51EF68C8845A9F7B1FF99300F11D79AE4587B125FB70AAD4CB81

Function 059F8968 Relevance: 2.3, Instructions: 2303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63531ed7ddb8cc333d709493848e745cad85288a15ba3964fcd6dbf8a7d37acd
Instruction ID: d0e9fb50ba30c5182101afa8927d766f3a0a09db00d8eba71480f9c6f1e37152
Opcode Fuzzy Hash: 63531ed7ddb8cc333d709493848e745cad85288a15ba3964fcd6dbf8a7d37acd
Instruction Fuzzy Hash: BE333E31D107198ECB15DF68C884AADF7B5FF99300F15C79AE448A7225EB70AAC5CB81

Function 059FE598 Relevance: 1.8, Strings: 1, Instructions: 588COMMON

Download Yara Rule

Strings

$, xrefs: 059FE966

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f3d7c98878679305492046b28f6eb4b0eabd4761d5561cd70d94c302a2084b6d
Instruction ID: 34885124f3fb32e340047adfb12fb10df013cae65a04ae89e5a8b16191d90485
Opcode Fuzzy Hash: f3d7c98878679305492046b28f6eb4b0eabd4761d5561cd70d94c302a2084b6d
Instruction Fuzzy Hash: 2B22B271F002198FDF64DB64C580ABEB7BAFF84310F248469E506AB3A4DA35DD45CB90

Function 05A2ED31 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05A2EDBE
GetCurrentThread.KERNEL32 ref: 05A2EDFB
GetCurrentProcess.KERNEL32 ref: 05A2EE38
GetCurrentThreadId.KERNEL32 ref: 05A2EE91

Memory Dump Source

Source File: 00000003.00000002.2895187143.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a20000_fMNDB.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f21970970e741bae847164da4381661aa21ae54a0ea6ae820ca2cd46ffc44d6e
Instruction ID: 9c53260f64a593e28ae4f46c607c83cedf185488a5aa198016af1ed19e2ecbdd
Opcode Fuzzy Hash: f21970970e741bae847164da4381661aa21ae54a0ea6ae820ca2cd46ffc44d6e
Instruction Fuzzy Hash: DE5156B09002499FDB14CFA9C549BAEBFF5AF48314F20845AE059B73A0DB34A984CF65

Function 05A2ED40 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05A2EDBE
GetCurrentThread.KERNEL32 ref: 05A2EDFB
GetCurrentProcess.KERNEL32 ref: 05A2EE38
GetCurrentThreadId.KERNEL32 ref: 05A2EE91

Memory Dump Source

Source File: 00000003.00000002.2895187143.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a20000_fMNDB.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 88cddbfea68893f338296f1a0fbb3c6207e610cba321350cb700b281c910071e
Instruction ID: 6f114ff46733663c2d80e2b0fccd0ab16f5dd73a99c5683cbbc279328ab6c540
Opcode Fuzzy Hash: 88cddbfea68893f338296f1a0fbb3c6207e610cba321350cb700b281c910071e
Instruction Fuzzy Hash: 8B5135B09002099FDB14DFAAD549BAEBFF5EF48314F208459E019B73A0DB34A984CF65

Function 059FDB40 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 059FDC6D
\Opq, xrefs: 059FDCF7
fpq, xrefs: 059FE24D

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: e0561c2baa6f421e6e03d6e789241b9c6f6bc7e973d820c7322cd6401e4b17bc
Instruction ID: 78c8febe84308d73ab7083bba7182835d1c0e68d5e005a14ff4c3669a8f8ecc8
Opcode Fuzzy Hash: e0561c2baa6f421e6e03d6e789241b9c6f6bc7e973d820c7322cd6401e4b17bc
Instruction Fuzzy Hash: 3C619170B002089FDB549BA9C814BAEBBF6FF88310F208429E506AB395DF744D458B90

Function 06236D18 Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06236F7E

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9aed5d3cca9864f6b8c90779e4befeb37f8c6c486b45f5a8b8bd9eeac269c5ee
Instruction ID: b1b054ead7ca5f83c4a2aa8d84ac7d45d5aa30efee0169bed7df95b12120861b
Opcode Fuzzy Hash: 9aed5d3cca9864f6b8c90779e4befeb37f8c6c486b45f5a8b8bd9eeac269c5ee
Instruction Fuzzy Hash: 5D8198B0A10B159FDB64CF29D44179ABBF5FF48304F10892ED88ADBA50DB34E949CB90

Function 06238510 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062386A2

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2f58da863b9bf029f921437c02cf2b1a0d261de87369b557e82605155e8ddc17
Instruction ID: d5c23267b4c9a3cd46e7d03a0800516aa53ac5e549ec3c1cca1bd8f5c0734f8a
Opcode Fuzzy Hash: 2f58da863b9bf029f921437c02cf2b1a0d261de87369b557e82605155e8ddc17
Instruction Fuzzy Hash: CD6120B1C10349AFCF12CFA9C980ADDBFB1BF49310F24856AE858AB261D7359881CF50

Function 05A29E40 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895187143.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a20000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697d1f059e7d2bfbc672e89ce55b1e03aad4f34e8804a575e4a0203cf6a80399
Instruction ID: 6c2a606595e680d63f885070e8c38abdb9c91b97ef89d4525d3abd544c93e44c
Opcode Fuzzy Hash: 697d1f059e7d2bfbc672e89ce55b1e03aad4f34e8804a575e4a0203cf6a80399
Instruction Fuzzy Hash: 87412572E047558FCB04DFA9D4046DEBBF5BF89320F14856AE505A7250DB38A885CBE1

Function 06238590 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062386A2

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 967ce2f4e0b9f23daf60f47b64ce921666abe8c3e4c6cceb680ce6035f485a5e
Instruction ID: b4ce82adc969c467ba06022cc0c0b37dfc084ff516d768ec170b51dc427f853c
Opcode Fuzzy Hash: 967ce2f4e0b9f23daf60f47b64ce921666abe8c3e4c6cceb680ce6035f485a5e
Instruction Fuzzy Hash: D941B0B1D10319DFDB14CF9AC984ADEBBF5BF48314F24812AE819AB250D775A885CF90

Function 0623951C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0623AD91

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 26c0e51fab8b80da5788f21918338167b8417c76cfcdc81d2e34a2985a5f529a
Instruction ID: 5285ffa59c70db1b99ac724d37f78895c8841b31c030e01a16b10fea37e05a61
Opcode Fuzzy Hash: 26c0e51fab8b80da5788f21918338167b8417c76cfcdc81d2e34a2985a5f529a
Instruction Fuzzy Hash: 314129B4A10319CFDB54CF99C448AAABBF5FF88314F24C459D959AB321D774A841CFA0

Function 05A2EF80 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A2F00F

Memory Dump Source

Source File: 00000003.00000002.2895187143.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a20000_fMNDB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bd7fee29b2d4ad13f6b9551345fa5bace6c1400545ddc714eea312f5937c3ad8
Instruction ID: a2b4f511d0c50f36d6ae0b8e37e8c5b721c13ec83fd562fae9fc9f2da15b767c
Opcode Fuzzy Hash: bd7fee29b2d4ad13f6b9551345fa5bace6c1400545ddc714eea312f5937c3ad8
Instruction Fuzzy Hash: CE2116B5900258EFDB10CF9AD985ADEBFF8EB48310F14801AE954A7350D378A944CFA5

Function 05A2EF88 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A2F00F

Memory Dump Source

Source File: 00000003.00000002.2895187143.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a20000_fMNDB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 36ccf2be1fe33bfe782567833b81fec4badf07a41f9b8c932bd028d7bf327692
Instruction ID: 0dab0c903a0cef10076c5ffde2609747e11137289fd1bef6f669594cfdd7d011
Opcode Fuzzy Hash: 36ccf2be1fe33bfe782567833b81fec4badf07a41f9b8c932bd028d7bf327692
Instruction Fuzzy Hash: 4721E4B59002189FDB10CF9AD985ADEBBF8EB48310F14801AE918A3350D378A940CFA5

Function 00779200 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00779274

Memory Dump Source

Source File: 00000003.00000002.2892294765.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_fMNDB.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 32a53828d5a0b8ef5cfa91eff3e6f9823ced1048208a33ae9e07da7291899989
Instruction ID: 6cf29ab1640cd7fdf5f34dd25f0e4fc422f68abde36d9a4c207b0aa9fe8abf26
Opcode Fuzzy Hash: 32a53828d5a0b8ef5cfa91eff3e6f9823ced1048208a33ae9e07da7291899989
Instruction Fuzzy Hash: 1C11F4B19002499FDB10DFAAC544A9EFBF4FF48320F10842AD559A7250C779A944CFA5

Function 06237178 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06236FF9,00000800,00000000,00000000), ref: 062371EA

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a137bd915e63658c0a8f0246c8e9b402976c200751ca7b703c1d6d30aeb0386f
Instruction ID: 4baa33ad25a4cb3b1d0f2b376262ea082e8dd26f2408ec39fb7528fe5e0722b7
Opcode Fuzzy Hash: a137bd915e63658c0a8f0246c8e9b402976c200751ca7b703c1d6d30aeb0386f
Instruction Fuzzy Hash: 632129B6C002599FDB10CFAAD844ADEFBF4EF48310F10842ED899A7210C378A545CFA5

Function 06235CF0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06236FF9,00000800,00000000,00000000), ref: 062371EA

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e2a02c84a688194e4edac0d1764517c3d0f7f2e87aa8de2e700565f8df634d6c
Instruction ID: 67084913807a6645e74ce59f92b05a753706eaf2005c169168c5976b6478bd73
Opcode Fuzzy Hash: e2a02c84a688194e4edac0d1764517c3d0f7f2e87aa8de2e700565f8df634d6c
Instruction Fuzzy Hash: D71117B6D003199FDB10CF9AD844ADEFBF4EB48310F10842AE959A7210C375A545CFA4

Function 05A29F28 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05A29F8F

Memory Dump Source

Source File: 00000003.00000002.2895187143.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a20000_fMNDB.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 784ad5f41101f13aecbba52739895b0cdcc215734033efa8f9a7e8dea7b56d51
Instruction ID: 1a2c23a948295b7f2bcd8232cd0bce739c79f58c6b83deafae5d56f0e7250c30
Opcode Fuzzy Hash: 784ad5f41101f13aecbba52739895b0cdcc215734033efa8f9a7e8dea7b56d51
Instruction Fuzzy Hash: 571120B1C002699FDB10CF9AC544BDEFBF4AF48320F10812AE828B7240D378A940CFA5

Function 059F4AD2 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

], xrefs: 059F4A34

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: 7b9c108604e0da41c48f23931310c4efe4ed66bf6a9e05228b139b2586122b5f
Instruction ID: 61947e5d790bf6ab6789386141415ce645f6684eeff16eabc5a7504d792acae2
Opcode Fuzzy Hash: 7b9c108604e0da41c48f23931310c4efe4ed66bf6a9e05228b139b2586122b5f
Instruction Fuzzy Hash: B1B15835A101048FDF14DB68D584AAEBBF6EB88321F148469E90AE7395DB35ED42CB60

Function 007793D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 0077943A

Memory Dump Source

Source File: 00000003.00000002.2892294765.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_fMNDB.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f5e34c47f1517b57476e4d0553a20faa88a29bb7c66444f475e3a8d1a36e401c
Instruction ID: f44b0ebd5499940868c50993a89c97579429d8a28faaf81a7fa6966132dc15e0
Opcode Fuzzy Hash: f5e34c47f1517b57476e4d0553a20faa88a29bb7c66444f475e3a8d1a36e401c
Instruction Fuzzy Hash: B8113AB19002488FDB20DFAAC4457DFFBF4EF88324F208429D559A7250C778A944CF94

Function 06236F18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06236F7E

Memory Dump Source

Source File: 00000003.00000002.2895638476.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6230000_fMNDB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0b99ac6954d836ae43161fcd32ae8d350416f832dd8a4658292607dbf070fbf7
Instruction ID: 2e42a41029f24eb845ff716a08a5affc949837afcad180c8b7692a4de3156d88
Opcode Fuzzy Hash: 0b99ac6954d836ae43161fcd32ae8d350416f832dd8a4658292607dbf070fbf7
Instruction Fuzzy Hash: 361110B5C003599FCB10CF9AC444BDEFBF8EB88324F10842AD829A7210C378A545CFA1

Function 059FDB30 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

XPpq, xrefs: 059FDC6D

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: 4fad339530ea08e6290c761d1f695bc7273c6aeffce09d2fac62af1a883135bf
Instruction ID: 481567642ea99aef7dd5bea17dafa781a905b5cab30ed03c108d11d16b7b6fc5
Opcode Fuzzy Hash: 4fad339530ea08e6290c761d1f695bc7273c6aeffce09d2fac62af1a883135bf
Instruction Fuzzy Hash: 91418471B102089FEB54DFA9C854BAEBBF6FF88300F208529E506AB3D5DA749C45CB50

Function 059FAF31 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 059FB07B

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: ca8ea5995e8204c2745a0c51fb0e0ecc675174b291d5885f8a5efdc224cd3936
Instruction ID: ca97965a047cc356268aa1a8c6f6733650efa459e52dea3cb4f4e5c0f784bba7
Opcode Fuzzy Hash: ca8ea5995e8204c2745a0c51fb0e0ecc675174b291d5885f8a5efdc224cd3936
Instruction Fuzzy Hash: B231C131B002018FDB199B34C65476E7BE7BB88210F148868E50ADB399EF39CC46CBD4

Function 059F1390 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LRkq, xrefs: 059F13D5

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: b51375202d6505799e5a1f039fc64e6350c84e2fe3c5c67591c54d46f9812b17
Instruction ID: 9e9deaed15bbfc51bf81c2555b6e5bcc4c6f29d0f0ba318dde23bb8efd6b98d2
Opcode Fuzzy Hash: b51375202d6505799e5a1f039fc64e6350c84e2fe3c5c67591c54d46f9812b17
Instruction Fuzzy Hash: 5131A430E10209DBDF14CFA4C544BAEB7B6FF85314F208925E902EB250DBB5E945DB91

Function 059F1380 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

LRkq, xrefs: 059F13D5

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 14d5350a35af629284f843086a0dd7e5776721a737096712251ba21a0d5a14fe
Instruction ID: acfff60c6d4b64697ea8cd2058fab0152a05f9980fb728eb218a8804f461fd4e
Opcode Fuzzy Hash: 14d5350a35af629284f843086a0dd7e5776721a737096712251ba21a0d5a14fe
Instruction Fuzzy Hash: 3F317230E10219DBDF14CF64C584BAEB7B6FF85314F208829E901EB250EBB5D946DB91

Function 059FAF08 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

PHkq, xrefs: 059FB07B

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: b6eda0b3a43c7c1846c267e3bfc7f811388cf233969beb922263ac7b9e59c3b9
Instruction ID: 1e777e792d5314e05ab7537d89b56960ba832df78b27a8f0111fe4a96b479442
Opcode Fuzzy Hash: b6eda0b3a43c7c1846c267e3bfc7f811388cf233969beb922263ac7b9e59c3b9
Instruction Fuzzy Hash: BE31E2717043418FCB1A9F34C66426E7BF7AF8A240B2884A9D14ADB3A9DF39CC45C795

Function 059F0D00 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

LRkq, xrefs: 059F0D27

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 4229bf46d984955499ca289be9b9f56db9b09997e6368930c5c1c7fca7a0fc55
Instruction ID: b33b03d4946f9ad85f2bad88a21577cb0be23c81a71e2670b2d7efe07fdf88aa
Opcode Fuzzy Hash: 4229bf46d984955499ca289be9b9f56db9b09997e6368930c5c1c7fca7a0fc55
Instruction Fuzzy Hash: 3911D5707051048FC715AB3DE014A9E3BB6EF85310B00887AE005CB7A9DE3498868795

Function 059F0CEB Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

LRkq, xrefs: 059F0D27

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 786742e964465ae88aa3b1b2705afa441dabe9d0aec5ec306a745c844e11f411
Instruction ID: 552ad9cd9c2b1dd9af623ee86aafafd454d3b8c3a51688cc25d13638609f5554
Opcode Fuzzy Hash: 786742e964465ae88aa3b1b2705afa441dabe9d0aec5ec306a745c844e11f411
Instruction Fuzzy Hash: 000128717042449FC715AB38841469E7BF6EF8A314B1180BAD019CB3A2DE359C4287A2

Function 059F2519 Relevance: .9, Instructions: 935COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d615099d86442cca1031063a526581c6750cc6924022bcf951a243195578a22
Instruction ID: 064ac3a598050cfc8c553a10f5a8492ff577eb42d934fb13aa8bb51120e34389
Opcode Fuzzy Hash: 3d615099d86442cca1031063a526581c6750cc6924022bcf951a243195578a22
Instruction Fuzzy Hash: 2282CD34B206048FCF24EB64D994E6D77B6FB8A314F10486AD809D7368EF35AD86DB50

Function 059F2528 Relevance: .9, Instructions: 934COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a201d5137c50db4d667e6adef6d143ba3a10b17a14e5b8961ec47169f4aed41d
Instruction ID: 93badefb396ebd5b548228a343ffdadd2a7a155a9c510bac57c3d54cbfa73485
Opcode Fuzzy Hash: a201d5137c50db4d667e6adef6d143ba3a10b17a14e5b8961ec47169f4aed41d
Instruction Fuzzy Hash: 8782CD34B206048FCF24EB64D984E6D77B6FB8A314F10486AD809D7368EF35AD86DB50

Function 059F1D69 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb2e1bdc53ddd965d547a728016a3e8b3432f0eef71298400dd53ba5e5336f4
Instruction ID: 614f76b64bced4ae5d7816cec91bc067e2f4033bf978c4e982674a5db320158a
Opcode Fuzzy Hash: 8fb2e1bdc53ddd965d547a728016a3e8b3432f0eef71298400dd53ba5e5336f4
Instruction Fuzzy Hash: D902DE347212008BDF192778A49927C3BE7FBC9362B64046DF90AC7391CEB9DD869761

Function 059F4AE0 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e143ad14946817d6885bbc2fda77a621b130242212b9e9911f4b923cba5a2d0c
Instruction ID: 5f268b2b5eca0baf7ceb8794c416293ede00902b07e4b217f39a96b291ec20b0
Opcode Fuzzy Hash: e143ad14946817d6885bbc2fda77a621b130242212b9e9911f4b923cba5a2d0c
Instruction Fuzzy Hash: 43E18D34B102059FCF14DB68D594AAEBBF6FB88310F208469E90AD73A5DB35ED41CB91

Function 059FF1C8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a8706e77424643eb955b0b89e5296f14d0ec1298ae7f81186690951a90104d
Instruction ID: de4bd37e53218007c8abc02e5d42da3de251dc6ee4c9c49aa5fdb6fa5cc6b553
Opcode Fuzzy Hash: b6a8706e77424643eb955b0b89e5296f14d0ec1298ae7f81186690951a90104d
Instruction Fuzzy Hash: 8961F6B2F001214BDF149A7DD884A6FBADBAFC4620B254036E90AD73B5DE79DC0287D1

Function 059F5030 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d559233e0770c278e04d24eaaffa7544faae7cd9ca15f093e0410a0789048924
Instruction ID: 861d9c637a9eb18f28fc84f7580dbe1451b04af1185d8f6feea73202fe2593fe
Opcode Fuzzy Hash: d559233e0770c278e04d24eaaffa7544faae7cd9ca15f093e0410a0789048924
Instruction Fuzzy Hash: B1818F71B002049FDB14DFA8D984B9DBBB5FF88320F15C269E9099B395EB71E845CB90

Function 059FD121 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6dcbff07be9b7ef58e3432e7eee983b2e67367a5bb70dbd8bc2458d8565859
Instruction ID: a4d17fbf7cdb854967515439aa784502757f6cf7e3f39d83d13d9fc3637ade8f
Opcode Fuzzy Hash: 7a6dcbff07be9b7ef58e3432e7eee983b2e67367a5bb70dbd8bc2458d8565859
Instruction Fuzzy Hash: 1D811930B102098FDF54DBA9D554AAE77F7EB88310F108429E50ADB398EB75EC468B91

Function 059FD460 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e290cd5f106b7e2601eeab771aa584d6853b5f1dad458590974d783dfe322532
Instruction ID: fe08103e8a61b1195c72a2693d04d608db6c26153a710264b380feef766441c7
Opcode Fuzzy Hash: e290cd5f106b7e2601eeab771aa584d6853b5f1dad458590974d783dfe322532
Instruction Fuzzy Hash: 0A615430E103099BDF10EBA8C850BADB7B6FF85310F104529E549FF294EB74A985CB91

Function 059FD470 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5acb666c21bcdf8d39377e11ea42ff221fd17a391547352257e8325e3c2754a
Instruction ID: a510d67ceb5f48ffeed4883d1f770924d036b48ac335897e848ede5728439694
Opcode Fuzzy Hash: d5acb666c21bcdf8d39377e11ea42ff221fd17a391547352257e8325e3c2754a
Instruction Fuzzy Hash: CC612130E107099BDF10EBA8C850BADB7B6FF89310F204529E549FF294DB74A985CB91

Function 059F4E50 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c28749d1a53c1f93d50a93033ddb929726106b2f4e3c465549a8e32c198a894
Instruction ID: b7d63c18ecc32ac80fa2cf1ef70191da91326f21fdd0cf239ef23fd1c343c28c
Opcode Fuzzy Hash: 0c28749d1a53c1f93d50a93033ddb929726106b2f4e3c465549a8e32c198a894
Instruction Fuzzy Hash: 9641AF31F102069BDF249A68D590B7FB7AAFB85310F20482AE60ED7395EB35DD418BC1

Function 059F4900 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107325a23135d7a2f044096959926c01c0b471b4b89689f89ea82a083dc190b8
Instruction ID: a0d2edd7dc9f5b44191164fc42b8d2c08c80cbd82706e00038d9cf2d1732c83e
Opcode Fuzzy Hash: 107325a23135d7a2f044096959926c01c0b471b4b89689f89ea82a083dc190b8
Instruction Fuzzy Hash: 9A41A430A106498BCF15DFA4D5616AEB7F6FF88310F108529EA0AE7394EB359D46CB50

Function 059F0E2C Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26c35ff718dd0d1b2db193afbccf13513e7b0d526c2c51dbf61bcb1ca288c3e
Instruction ID: d4f32770b5bc51682268a344e1e69a35c6716af7b55417e54936c54429fdd3ab
Opcode Fuzzy Hash: d26c35ff718dd0d1b2db193afbccf13513e7b0d526c2c51dbf61bcb1ca288c3e
Instruction Fuzzy Hash: CC5115B1E102189FDB14CFA9C888B9DBBF5BF48310F14812AE81ABB395D7749944CF94

Function 059F0E38 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074baa848845ead3baf68c5d450464991dae561f8d107f252535c54beb7d7897
Instruction ID: f0ca80f77047af4c55ea5d65b06f703c54bbff5adf8af3a4dec321e0674b73f5
Opcode Fuzzy Hash: 074baa848845ead3baf68c5d450464991dae561f8d107f252535c54beb7d7897
Instruction Fuzzy Hash: 895116B0D102189FDB14CFA9C888B9DBBF9BF48310F548129E81ABB395D774A944CF95

Function 059FE412 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40de0b3fbcdb58b88ae44dd2630eb953eee77907fc19016054a9d51833e913d2
Instruction ID: 8b20a5a8151a6b63633b9c059372d6c505d0a1eed872ea123dcf6ce5d4e59e9c
Opcode Fuzzy Hash: 40de0b3fbcdb58b88ae44dd2630eb953eee77907fc19016054a9d51833e913d2
Instruction Fuzzy Hash: BF418271A006098FDF70CF99D880ABFF7BAFB84310F10492AD256D7660D330E9458B91

Function 059FADA0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d5c3a121ded9a6fffd47bbd1224662e22d1c1c79f982d7dd4349c7cb9df67d
Instruction ID: bdac2bdbf9ea8b8908023e7a5fcaebecc0a2a4c4e478ae1e42d1a17d39ef643b
Opcode Fuzzy Hash: 25d5c3a121ded9a6fffd47bbd1224662e22d1c1c79f982d7dd4349c7cb9df67d
Instruction Fuzzy Hash: 9A315E31B106058BCB19DF64D5546AEB7F7AFC9310F108429E90AEB354EF35ED4687A0

Function 059FADB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d21ed79c84398ce44b96d56ed30327fd13cacddbe7ce3c4c1e2d6ed77a9311e
Instruction ID: 37e6024c9240aef3e7300c50ae8adebf2f0f601bbe5b2cceb8882d68b4f3d51d
Opcode Fuzzy Hash: 6d21ed79c84398ce44b96d56ed30327fd13cacddbe7ce3c4c1e2d6ed77a9311e
Instruction Fuzzy Hash: 7B316F30B106058BCB19DF64D4546AEB7F6AFC9310F508429E90AEB354EF34ED428790

Function 059F4928 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f89e3274053ef44ee890bc9944eca33c9375e8cd2cb2ae8008c03df74fadea
Instruction ID: bc2ae61a89ce90949601e30a5bb11668df3be2dd85b36fc27c58cf166ff8883c
Opcode Fuzzy Hash: c9f89e3274053ef44ee890bc9944eca33c9375e8cd2cb2ae8008c03df74fadea
Instruction Fuzzy Hash: D3319F30B106098BCF15DFA5D454AAEB7B6FF89310F108529E905E7354EB71EC86CB60

Function 059FCD30 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ffbf2946f61a5392426a023470e31113d9a5a01960d9828b322fefa3753aa60
Instruction ID: cfc8d4f5c6089365146d514bce466384c50d0525bff0f48846b94a721d266315
Opcode Fuzzy Hash: 2ffbf2946f61a5392426a023470e31113d9a5a01960d9828b322fefa3753aa60
Instruction Fuzzy Hash: 3A217C75F102199FDB00DF69D941AAEBBF5BB48310F108026EA05E7358EB30DC008BA4

Function 059FCD20 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5ce222f0e47223b0e0006377a0dfb4ad7f2b4d23e5bb587458dcbe82b8abb5
Instruction ID: cae6c26c4582cb1bbcf81870f5e055e4c1f25de8cee4d16e63f7e3a69a8f27ac
Opcode Fuzzy Hash: db5ce222f0e47223b0e0006377a0dfb4ad7f2b4d23e5bb587458dcbe82b8abb5
Instruction Fuzzy Hash: 96216B75F102199FDB04DFA9D981AEEBBF5BB48310F118426EA05E7358EB34EC418B94

Function 059F47EF Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b785e67c03a1698d0fb45066fe5a1f67e520602573a84bb025d129bdd765f47
Instruction ID: e7e655808d8cc75da8bfaf0f1272ad28a02063b0b2613ee08ea6d8c8287f4bc4
Opcode Fuzzy Hash: 4b785e67c03a1698d0fb45066fe5a1f67e520602573a84bb025d129bdd765f47
Instruction Fuzzy Hash: 3D21B070E102498BDF08CFA4D6546AEB7B7BF88310F10852AEA16F7390EB749C42CB50

Function 0071D5E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2891954222.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71d000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecd3c2b53816c2606974588ddcb0469dd1a88914060f11559af180fad2dc57f
Instruction ID: b6617b23f453b85fabba4afdaac1aa474f5446dea972d058f5c56177eb92ec94
Opcode Fuzzy Hash: 9ecd3c2b53816c2606974588ddcb0469dd1a88914060f11559af180fad2dc57f
Instruction Fuzzy Hash: 712125B1500204DFCB25DF18DAC0B6BBFA5FB98354F208569D80D0B296C33ADC96CAA1

Function 059F4800 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8961cea877b08a554cf46871adfa80b430be208efb4fac174f3d4fadc3ce71
Instruction ID: 16ec468db772e701e48bd4716904160591a67f9114cbdfaff37ec2beecc2d4ec
Opcode Fuzzy Hash: 6f8961cea877b08a554cf46871adfa80b430be208efb4fac174f3d4fadc3ce71
Instruction Fuzzy Hash: D6218030E102599BDF18CFA4D5546AEB7B6BF89310F20852AE916FB390EB74AC45CB50

Function 0072D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2892039521.000000000072D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0072D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72d000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3473e64b7571910cd347559b16da389b29abbf7575792bd28a0a289aa6877783
Instruction ID: 3aa3abfb71ac1c598d79a8f82b895e38494b5ac459d10a7fc193cbdaf9fdc410
Opcode Fuzzy Hash: 3473e64b7571910cd347559b16da389b29abbf7575792bd28a0a289aa6877783
Instruction Fuzzy Hash: C521F2B1504244DFCB34DF14E9C4B26BBA5EB88314F34C669D9494B266C33ADC46CA62

Function 059FC2B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7722f2b075df924045255f03b3a9c8af873b788d7dcd52b9294e0a83cfe97a
Instruction ID: a795cb1ca7cc87803a4196da0f9b979dbe7cd9534a1cd69067c8999f30119fe9
Opcode Fuzzy Hash: ef7722f2b075df924045255f03b3a9c8af873b788d7dcd52b9294e0a83cfe97a
Instruction Fuzzy Hash: 0A21AF72E042199BCF18DB68D9805DDF7B6EB89310F10886AD10AEB344EA31DE458BA0

Function 059F5022 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40474d90aa17d1b40153d4f8abdfba70e295d62114d4cc1e27686546c4f9a138
Instruction ID: c4fd309c80bdd73235308daf4f491eb75e4954335ec2f937abaabbd2ab21b1f0
Opcode Fuzzy Hash: 40474d90aa17d1b40153d4f8abdfba70e295d62114d4cc1e27686546c4f9a138
Instruction Fuzzy Hash: DF11D372A002048FDB14EB68D94479ABB62FF80321F148675D90D5B39AEB35E94ACBD0

Function 059FCE48 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb202a7ad6cb5bd1a67711f0b398a6a0f5b8946bdc0213c885baa58c07241a9
Instruction ID: 984f406cac20b781e13bff165e9d317e45529476c4488abde1495512251521f1
Opcode Fuzzy Hash: 4eb202a7ad6cb5bd1a67711f0b398a6a0f5b8946bdc0213c885baa58c07241a9
Instruction Fuzzy Hash: F1116D31B241299BCF14DA78D914ABE73EBABC8710F008539D50AE7358EE74DC029BA1

Function 0071D5E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2891954222.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71d000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 27d89d1fc5f0f79e6497a87e379ea5efb30c84f30c4810adec7ae23068c8664c
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 2E11B176504240CFCB16CF14D9C4B56BF72FB94314F24C5A9D8090B256C33AD85ACFA1

Function 059FD07F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a05c5f4c6f2de2b58d937f68cfe7ef4edb0a02f3d8c1cff174f104d917ed52
Instruction ID: 5da0e5eeb5171092b49573c092642f7ac0d243bba2c52ba4a303afff7bbe1841
Opcode Fuzzy Hash: 97a05c5f4c6f2de2b58d937f68cfe7ef4edb0a02f3d8c1cff174f104d917ed52
Instruction Fuzzy Hash: 7B0184327001140FDB159ABC9555B7AB7EBEBC9720F10883AEA0AC7394EE66DD064791

Function 0072D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2892039521.000000000072D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0072D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72d000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction ID: ff15eac83f79c5185ece25e3b6984a621d568303c9caa6b388156d05ab8b3706
Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction Fuzzy Hash: 8811BB75504284CFCB21CF14E5C4B15BBA1FB88314F28C6AAD8494B666C33AD84ACB62

Function 059FCAF9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32701ab3603c81a1f85e86020caa5880317756493bf53ab6f15a14d24167409
Instruction ID: 971d96f000a342a40148f5c9a2927d2c8515bbd015d89e5cb94c12a3367d3697
Opcode Fuzzy Hash: f32701ab3603c81a1f85e86020caa5880317756493bf53ab6f15a14d24167409
Instruction Fuzzy Hash: 8921BFB5D01259DFCB00DF9AD984ADEFBB4FB49310F10812AE918B7240D374A954CFA4

Function 059FCB00 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ab8c85ba39234125a4a101dc06ed6fbff028edf7f563ab0f077434223ff5b8
Instruction ID: 237d36ed158cac391c25b0954bef0630856ef9eec6c21020b48e042fd7e1f3bb
Opcode Fuzzy Hash: 73ab8c85ba39234125a4a101dc06ed6fbff028edf7f563ab0f077434223ff5b8
Instruction Fuzzy Hash: E311C3B59012199BCB00DF9AD884ACEFBB8BB49310F10812AE518B7240C374A954CFA5

Function 059FD090 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab610f66bb03237509e74313fe46233273ae35a172b66898a83c8118c57510a4
Instruction ID: c56175f5f6c795414c94cee8007a49eccea0daef94e5066970b0b1c5f6817cc0
Opcode Fuzzy Hash: ab610f66bb03237509e74313fe46233273ae35a172b66898a83c8118c57510a4
Instruction Fuzzy Hash: 93016D317001140BDB249ABD9455B3BA7EFEBC9730F20883AE60AC7394EE66DC424791

Function 059FCE39 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd0f12604547a81b7548a3beb9800e2529ab6ba35fb5b38e8fee57fbb910285
Instruction ID: 8cf36e76ba60d06fe406fd6a3bff19fcb5aeaeea6c048b33ea3709f4f0a0b92e
Opcode Fuzzy Hash: 7fd0f12604547a81b7548a3beb9800e2529ab6ba35fb5b38e8fee57fbb910285
Instruction Fuzzy Hash: 00014F32B200194BDF54D6A899146FE73AFABC8711F01843AD50AD7358EE64DD0647D1

Function 0071D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2891954222.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71d000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524a058475a9b3c7125740e45e04241fa4d6f31c8ba4b0d6ed6be1bdcce99f82
Instruction ID: 2c48eafb443fb559a19fb2ab4d897aa360946e5c46873451e7e7eb313de4ab5f
Opcode Fuzzy Hash: 524a058475a9b3c7125740e45e04241fa4d6f31c8ba4b0d6ed6be1bdcce99f82
Instruction Fuzzy Hash: CF01A771509340AAE7204A6DC984BA7BFD8DF59324F18C529ED494A2C6C27D9C85CEB1

Function 059F14A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dab2a6d3287e43096bea16d21af3256a27289c3b5ee02486ce5061bf031b53
Instruction ID: ebe2ea9cbaac08170b4ba4937a36f3e44a5d798298770dc4e23f56165908ef98
Opcode Fuzzy Hash: a2dab2a6d3287e43096bea16d21af3256a27289c3b5ee02486ce5061bf031b53
Instruction Fuzzy Hash: A8012835B00204CFCB19EB64D558B6C77B2FF88216F1400A5E5069B3B4CF35AD86DB40

Function 059F2478 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bebad0e7314efca0b183847da2df5fdb54bc8e0a633f0836fda6d1aab2f51e
Instruction ID: 95f30f13e58e9d9f66b3820ca3b3d6395443327c1474f89cbf046a7541df72c7
Opcode Fuzzy Hash: 20bebad0e7314efca0b183847da2df5fdb54bc8e0a633f0836fda6d1aab2f51e
Instruction Fuzzy Hash: F601D830550049DFCF05FBA9EA8999C7BB2DB41304F404AB8C1455F2BAEF706F499741

Function 0071D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2891954222.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71d000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9715c56e227549ef64655b9deb9881d3a4d07de70333cc668c5331cabc0dc7e8
Instruction ID: ce64d4acd053a56e2298f2a895f580dc6b2b99837e2fe6b2551dd1d723d4a7aa
Opcode Fuzzy Hash: 9715c56e227549ef64655b9deb9881d3a4d07de70333cc668c5331cabc0dc7e8
Instruction Fuzzy Hash: E8F06271405344AEE7208E1AC9C4BA3FFA8EB55724F18C55AED484E2C6C27D9C85CAB1

Function 059F2488 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9714d0f7172136b4a874daee5b857be8766a43e951216a5f4ffb8e6d6bc51573
Instruction ID: 721b395137d0f761903b9ab711e434e0e757c7a197aeea746e3f07075b4fc79d
Opcode Fuzzy Hash: 9714d0f7172136b4a874daee5b857be8766a43e951216a5f4ffb8e6d6bc51573
Instruction Fuzzy Hash: 5401FF30950109DFCF00FBA9EA4999DBBB6EB41304F504A74C40597269EF70AF499791

Function 059FF450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2895152888.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_59f0000_fMNDB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738c817c8d20f493b5beb3b0d72d192b3b85e8cc7d9f7069dbe14b078e35f467
Instruction ID: 6b8c31201e5bd4c94223dce56eb1d4489d8d4d9b1b5ed106ae5ac5a846faf9bf
Opcode Fuzzy Hash: 738c817c8d20f493b5beb3b0d72d192b3b85e8cc7d9f7069dbe14b078e35f467
Instruction Fuzzy Hash: 37E0D8B2A052459FEB10CE748988AAEBB7EEB16308F1054EAD554D7203E175CB468351

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe

C:\Users\user\AppData\Roaming\fMNDB\fMNDB.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189_dump.exe

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 0277C418 Relevance: 8.0, Strings: 6, Instructions: 547
COMMON

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Function 05B6ED31 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
threadCOMMON

Function 05B6ED40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre