Edit tour

Windows Analysis Report
TMX.exe

Overview

General Information

Sample name:	TMX.exe
Analysis ID:	1503269
MD5:	c3ac80cb293b407a4f4065c9fa978b97
SHA1:	9ebb9bc726023abe689bfdf5d7e7be5193896771
SHA256:	a4b87f426a36ea97a0f437eea63774f7949fc1f24d293ab9bd79b77fb8355e5b
Tags:	exe
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

AI detected suspicious sample

PE file has nameless sections

Queries Google from non browser process on port 80

Query firmware table information (likely to detect VMs)

Tries to evade debugger and weak emulator (self modifying code)

Tries to resolve many domain names, but no domain seems valid

Yara detected QueryWinSAT ClassID

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Creates files inside the system directory

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

TMX.exe (PID: 7604 cmdline: "C:\Users\user\Desktop\TMX.exe" MD5: C3AC80CB293B407A4F4065C9FA978B97)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_a7da40b7	unknown	unknown	0xb5fa:$a: 18 B9 10 00 00 00 83 E2 0F 2B CA 3B 4D 14 76 03 8B 4D 14 8D 5C
00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_d4b38e13	unknown	unknown	0x875d:$a: 5B 5D C2 04 00 8B C2 5F 5E 5B 5D C2 04 00 55 8B EC 57 8B 45 08 0F
00000000.00000003.2007533311.000000000882E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
00000000.00000002.3616445614.0000000003660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_a7da40b7	unknown	unknown	0xb67ee:$a: 18 B9 10 00 00 00 83 E2 0F 2B CA 3B 4D 14 76 03 8B 4D 14 8D 5C
00000000.00000003.1922586734.0000000008826000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
00000000.00000003.1967410646.0000000008826000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
00000000.00000002.3654782238.0000000008826000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
00000000.00000003.1928800347.000000000882D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
00000000.00000003.2039876701.000000000882E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
Process Memory Space: TMX.exe PID: 7604	JoeSecurity_QueryWinSATClassID	Yara detected QueryWinSAT ClassID	Joe Security
Click to see the 5 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 172.217.23.100

Timestamp:	2024-09-03T09:30:54.698994+0200
SID:	2803274
Severity:	2
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.6% probability

Compliance

Uses 32bit PE files

Source: TMX.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: TMX.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TMX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: adwsmigrate.pdbGCTL source: adwsmigrate.dll0.0.dr
Source:	Binary string: SetupError.pdb source: setuperror.exe.0.dr
Source:	Binary string: adwsmigrate.pdb source: adwsmigrate.dll0.0.dr
Source:	Binary string: spwizeng.pdbGCTL source: spwizeng.dll.0.dr
Source:	Binary string: SetupError.pdbGCTL source: setuperror.exe.0.dr
Source:	Binary string: spwizeng.pdb source: spwizeng.dll.0.dr

Spreading

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Source: C:\Users\user\Desktop\TMX.exe

Directory queried: number of queries: 1001

Networking

Queries Google from non browser process on port 80

Source: C:\Users\user\Desktop\TMX.exe

HTTP traffic: GET / HTTP/1.1 User-Agent: test Host: www.google.com

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: 108.211.229.192.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 157.123.68.40.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 240.221.184.93.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 172.214.232.199.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 95.221.229.192.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.36.159.162.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 198.187.3.20.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 233.38.18.104.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 23.149.64.172.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 68.32.126.40.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 3.61.159.162.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 146.78.124.51.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 103.169.127.40.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 26.35.223.20.in-addr.arpa replaycode: Name error (3)

Suricata IDS alerts with low severity for network traffic

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 172.217.23.100:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: testHost: www.google.com

Source: global traffic	DNS traffic detected: DNS query: 51.162.222.173.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 23.149.64.172.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 233.38.18.104.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 26.35.223.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 240.221.184.93.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 3.61.159.162.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 32.162.222.173.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 108.211.229.192.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 100.23.217.172.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 172.214.232.199.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 146.78.124.51.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 157.123.68.40.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 68.32.126.40.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 95.221.229.192.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 2.36.159.162.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 103.169.127.40.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 168.100.16.2.in-addr.arpa

Source: TMX.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: TMX.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: TMX.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: TMX.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: TMX.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: TMX.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: TMX.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: TMX.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TMX.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: TMX.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: TMX.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://madExcept.comU
Source: TMX.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: TMX.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: TMX.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: TMX.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: TMX.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: TMX.exe, 00000000.00000003.1923928414.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: TMX.exe, 00000000.00000003.1756858545.00000000069CA000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TMX.exe, 00000000.00000003.1765271807.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1764821428.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765198220.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1764735488.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765007498.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765313259.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765093780.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765386243.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765157921.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765425389.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1764770433.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: TMX.exe, 00000000.00000003.1765606331.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765652198.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765531183.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm=
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: TMX.exe, 00000000.00000003.1864715936.00000000087CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: TMX.exe, 00000000.00000003.1864715936.00000000086DB000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/-
Source: TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/A
Source: TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/E
Source: TMX.exe, 00000000.00000003.1863921116.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3654782238.0000000008812000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1922586734.000000000880F000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1967410646.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.2007533311.000000000881A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/l
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.google.com/search?newwindow=1&q=%sopenU
Source: TMX.exe, 00000000.00000003.1863921116.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3654782238.0000000008812000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1922586734.000000000880F000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1967410646.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.2007533311.000000000881A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/z
Source: TMX.exe, 00000000.00000003.1864715936.00000000087CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com9~2
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.google.comU
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mitec.cz/exe.htmlopenU
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: TMX.exe, 00000000.00000003.1753479626.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1753400342.00000000069E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: TMX.exe, 00000000.00000003.1753479626.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1753400342.00000000069E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.neti
Source: TMX.exe, 00000000.00000003.1753479626.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1753400342.00000000069E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netl
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: TMX.exe, 00000000.00000003.1886157496.000000000876F000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1923928414.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
Source: TMX.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mitec.cz
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp, TMX.exe, 00000000.00000002.3618921590.0000000003766000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mitec.cz/tmx.html#Pricing
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp, TMX.exe, 00000000.00000002.3618921590.0000000003766000.00000004.00001000.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3607807663.00000000012D3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mitec.cz/webupdate.html
Source: TMX.exe	String found in binary or memory: https://www.mitec.cz0
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mitec.czopenS
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/domain/report?domain=%s&apikey=%s
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/file/report
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/file/rescanU
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/file/scan
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/ip-address/report?ip=%s&apikey=%s
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/url/report
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.virustotal.com/vtapi/v2/url/scan

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\sources\appraiserdatasha1.cat	Jump to dropped file
Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\efi\microsoft\boot\winsipolicy.p7b	Jump to dropped file
Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\sources\db_msftproductionwindowssigningca.cer	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_a7da40b7 Author: unknown
Source: 00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_d4b38e13 Author: unknown
Source: 00000000.00000002.3616445614.0000000003660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_a7da40b7 Author: unknown

PE file has nameless sections

Source: TMX.exe	Static PE information: section name:
Source: TMX.exe	Static PE information: section name:
Source: TMX.exe	Static PE information: section name:
Source: TMX.exe	Static PE information: section name:
Source: TMX.exe	Static PE information: section name:
Source: TMX.exe	Static PE information: section name:

Creates files inside the system directory

Source: C:\Users\user\Desktop\TMX.exe	File created: C:\Windows\INF\c_processor.PNF	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File created: C:\Windows\INF\c_monitor.PNF	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File created: C:\Windows\INF\c_volume.PNF	Jump to behavior

Enables security privileges

Source: C:\Users\user\Desktop\TMX.exe

Process token adjusted: Security

Jump to behavior

PE file contains executable resources (Code or Archives)

Source: TMX.exe	Static PE information: Resource name: RT_GROUP_CURSOR type: COM executable for DOS
Source: netsetupengine.dll.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: mapsmigplugin.dll.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: acres.dll.mui.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: acres.dll.mui.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: acres.dll.mui.0.dr	Static PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: acres.dll.mui.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: wdsclient.dll.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: wdsimage.dll.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: wdstptc.dll.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

PE file does not import any functions

Source: setupugcetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: sxsmigplugin.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: w32uires.dll.0.dr	Static PE information: No import functions for PE file found
Source: memtest.exe.0.dr	Static PE information: No import functions for PE file found
Source: winsetupetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: dismapi.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: imagingprovider.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: compres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: setupcompat.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: acres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: actionqueue.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: compatctrl.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: w32uires.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: setuperror.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: uxlibres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: windlp.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: folderprovider.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: setupetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: nlsbres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: dism.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: actionqueueetw.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: reagent.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: cmisetup.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: actionqueueetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: logprovider.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: auditetw.dll0.0.dr	Static PE information: No import functions for PE file found
Source: mediasetupuimgr.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: arunres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: bootsect.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: smiengine.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: bootres.dll.0.dr	Static PE information: No import functions for PE file found
Source: wimprovider.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: actionqueueetw.dll0.0.dr	Static PE information: No import functions for PE file found
Source: wdsclient.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: shmig.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: appraiserwc.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: input.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: dismprov.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: auditetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: cscmig.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: migres.dll.0.dr	Static PE information: No import functions for PE file found
Source: dismcore.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: sysprepetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: pnpibs.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: appraiser.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: winsetup.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: rollback.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: cmisetupetw.dll0.0.dr	Static PE information: No import functions for PE file found
Source: setup.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: compatresources.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: oobeldretw.dll.0.dr	Static PE information: No import functions for PE file found
Source: upgloader.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: migres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: vhdprovider.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: bootres.dll0.0.dr	Static PE information: No import functions for PE file found
Source: windeployetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: setupplatform.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: nlsbres.dll.0.dr	Static PE information: No import functions for PE file found
Source: setupcore.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: w32uiimg.dll.0.dr	Static PE information: No import functions for PE file found
Source: spwizres.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: setupprep.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: cmisetupetw.dll.0.dr	Static PE information: No import functions for PE file found
Source: setupcletw.dll.0.dr	Static PE information: No import functions for PE file found
Source: wdsimage.dll.mui.0.dr	Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs TMX.exe
Source: TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: \OriginalFileName vs TMX.exe
Source: TMX.exe, 00000000.00000002.3618921590.0000000003766000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCredentialEnrollmentManager.exe.muij% vs TMX.exe
Source: TMX.exe, 00000000.00000002.3618921590.00000000039C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedllhost.exej% vs TMX.exe
Source: TMX.exe, 00000000.00000002.3632435424.000000000550E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs TMX.exe
Source: TMX.exe, 00000000.00000002.3618921590.000000000392D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesvchost.exe.muij% vs TMX.exe

Uses 32bit PE files

Source: TMX.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Yara signature match

Source: 00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_a7da40b7 reference_sample = 2fb7241ffdfa7525f125e6d7b18e895cfb512ebb6905d056dbe7d76e8d6df806, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 62a62ede10d977582329b3daaa80b0b64576add77736135bac97d3a3eb6de558, id = a7da40b7-63cc-4456-a592-0485932092d5, last_modified = 2022-04-12
Source: 00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_d4b38e13 reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = c91f97a7e609d8138f8c5c7dd66cf675b1b3762f26baa5bf983ee212011b99cb, id = d4b38e13-1439-4549-ba90-0b4a8ed57fb3, last_modified = 2022-04-12
Source: 00000000.00000002.3616445614.0000000003660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_a7da40b7 reference_sample = 2fb7241ffdfa7525f125e6d7b18e895cfb512ebb6905d056dbe7d76e8d6df806, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 62a62ede10d977582329b3daaa80b0b64576add77736135bac97d3a3eb6de558, id = a7da40b7-63cc-4456-a592-0485932092d5, last_modified = 2022-04-12

Source: TMX.exe

Static PE information: Section: ZLIB complexity 0.9994050854933175

Source: TMX.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal42.troj.evad.winEXE@1/908@19/1

Source: C:\Users\user\Desktop\TMX.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\BXSHN514.htm

Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\{C7BF0490-CBE5-4D24-A39C-62AB53AC34CD}

Source: C:\Users\user\Desktop\TMX.exe

File created: C:\Users\user\AppData\Local\Temp\TMX.madExcept

Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe

File read: C:\Users\user\Desktop\TMX.exe

Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: slwga.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: perfdisk.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: perfproc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: msscntrs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rasctrs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: tapiperf.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: usbperf.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mmcshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: hhsetup.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wuapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wups.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wnaspi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: wnaspi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winsatapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Section loaded: inputhost.dll	Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\Desktop\TMX.exe

Window found: window name: TComboBox

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: TMX.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: TMX.exe

Static file information: File size 4610952 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TMX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: adwsmigrate.pdbGCTL source: adwsmigrate.dll0.0.dr
Source:	Binary string: SetupError.pdb source: setuperror.exe.0.dr
Source:	Binary string: adwsmigrate.pdb source: adwsmigrate.dll0.0.dr
Source:	Binary string: spwizeng.pdbGCTL source: spwizeng.dll.0.dr
Source:	Binary string: SetupError.pdbGCTL source: setuperror.exe.0.dr
Source:	Binary string: spwizeng.pdb source: spwizeng.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\TMX.exe

Unpacked PE file: 0.2.TMX.exe.9f0000.0.unpack Unknown_Section0:R;Unknown_Section1:W;Unknown_Section2:R;Unknown_Section3:W;.rsrc:R;Unknown_Section5:W;Unknown_Section6:EW; vs Unknown_Section0:R;Unknown_Section1:W;Unknown_Section2:R;Unknown_Section3:W;.rsrc:R;Unknown_Section5:W;Unknown_Section6:EW;#QWI:R;

Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\bootmgr.efi	Jump to dropped file
Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\efi\microsoft\boot\cdboot.efi	Jump to dropped file
Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\efi\microsoft\boot\cdboot_noprompt.efi	Jump to dropped file
Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\efi\microsoft\boot\memtest.efi	Jump to dropped file
Source: C:\Users\user\Desktop\TMX.exe	File created: \Device\CdRom0\efi\boot\bootx64.efi	Jump to dropped file

Source: C:\Users\user\Desktop\TMX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe	File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe	Window / User API: threadDelayed 511	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Window / User API: threadDelayed 1765	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Window / User API: threadDelayed 1015	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	Window / User API: threadDelayed 1626	Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe TID: 7768	Thread sleep time: -51100s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe TID: 7760	Thread sleep time: -176500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe TID: 7764	Thread sleep time: -101500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe TID: 7760	Thread sleep time: -162600s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TMX.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior

Source: TMX.exe, 00000000.00000002.3613256857.0000000001B57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: TMX.exe, 00000000.00000003.2723647797.00000000086D7000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1967410646.0000000008826000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: TMX.exe, 00000000.00000003.1967410646.00000000087CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe
Source: TMX.exe, 00000000.00000002.3632435424.000000000547B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: Yara match	File source: 00000000.00000003.2007533311.000000000882E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1922586734.0000000008826000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1967410646.0000000008826000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3654782238.0000000008826000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1928800347.000000000882D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2039876701.000000000882E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TMX.exe PID: 7604, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	13 Virtualization/Sandbox Evasion	LSASS Memory	13 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	122 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
\Device\CdRom0\boot\bootsect.exe	0%	ReversingLabs
\Device\CdRom0\boot\en-gb\bootsect.exe.mui	0%	ReversingLabs
\Device\CdRom0\boot\memtest.exe	0%	ReversingLabs
\Device\CdRom0\boot\resources\bootres.dll	0%	ReversingLabs
\Device\CdRom0\bootmgr	0%	ReversingLabs
\Device\CdRom0\bootmgr.efi	0%	ReversingLabs
\Device\CdRom0\efi\boot\bootx64.efi	0%	ReversingLabs
\Device\CdRom0\efi\microsoft\boot\cdboot.efi	0%	ReversingLabs
\Device\CdRom0\efi\microsoft\boot\cdboot_noprompt.efi	0%	ReversingLabs
\Device\CdRom0\efi\microsoft\boot\memtest.efi	0%	ReversingLabs
\Device\CdRom0\efi\microsoft\boot\resources\bootres.dll	0%	ReversingLabs
\Device\CdRom0\setup.exe	0%	ReversingLabs
\Device\CdRom0\sources\acmigration.dll	0%	ReversingLabs
\Device\CdRom0\sources\acres.dll	0%	ReversingLabs
\Device\CdRom0\sources\actionqueue.dll	0%	ReversingLabs
\Device\CdRom0\sources\adfscomp.dll	0%	ReversingLabs
\Device\CdRom0\sources\admtv3check.dll	0%	ReversingLabs
\Device\CdRom0\sources\aeinv.dll	0%	ReversingLabs
\Device\CdRom0\sources\appcompatservicing.dll	0%	ReversingLabs
\Device\CdRom0\sources\appraiser.dll	0%	ReversingLabs
\Device\CdRom0\sources\appraiserres.dll	0%	ReversingLabs
\Device\CdRom0\sources\appraiserwc.dll	0%	ReversingLabs
\Device\CdRom0\sources\arunimg.dll	0%	ReversingLabs
\Device\CdRom0\sources\arunres.dll	0%	ReversingLabs
\Device\CdRom0\sources\autorun.dll	0%	ReversingLabs
\Device\CdRom0\sources\clustercompliance.dll	0%	ReversingLabs
\Device\CdRom0\sources\cmi2migxml.dll	0%	ReversingLabs
\Device\CdRom0\sources\cmisetup.dll	0%	ReversingLabs
\Device\CdRom0\sources\compatctrl.dll	0%	ReversingLabs
\Device\CdRom0\sources\compatresources.dll	0%	ReversingLabs
\Device\CdRom0\sources\compres.dll	0%	ReversingLabs
\Device\CdRom0\sources\cryptosetup.dll	0%	ReversingLabs
\Device\CdRom0\sources\csiagent.dll	0%	ReversingLabs
\Device\CdRom0\sources\devinv.dll	0%	ReversingLabs
\Device\CdRom0\sources\diager.dll	0%	ReversingLabs
\Device\CdRom0\sources\diagnostic.dll	0%	ReversingLabs
\Device\CdRom0\sources\diagtrack.dll	0%	ReversingLabs
\Device\CdRom0\sources\diagtrackrunner.exe	0%	ReversingLabs
\Device\CdRom0\sources\dism.exe	0%	ReversingLabs
\Device\CdRom0\sources\dismapi.dll	0%	ReversingLabs
\Device\CdRom0\sources\dismcore.dll	0%	ReversingLabs
\Device\CdRom0\sources\dismcoreps.dll	0%	ReversingLabs
\Device\CdRom0\sources\dismprov.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-activedirectory-webservices-dl\adwsmigrate.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-bluetooth-config\bthmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-com-complus-setup-dl\commig.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-com-dtc-setup-dl\msdtcstp.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-dhcpservermigplugin-dl\dhcpsrvmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-directoryservices-adam-dl\adammigrate.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-iasserver-migplugin\iasmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-iasserver-migplugin\iasmigreader.exe	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-ie-clientnetworkprotocolimplementation-migration\wininetplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-internet-naming-service-runtime\winsplgn.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-msmq-messagingcoreservice\mqmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-networkbridge\bridgemigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-networkloadbalancing-core\nlbmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-rasconnectionmanager\cmmigr.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-rasserver-migplugin\rasmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-tapisetup\tapimigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-terminalservices-licenseserver\tlsmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-textservicesframework-migration-dl\chxmig.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-textservicesframework-migration-dl\imjpmig.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-textservicesframework-migration-dl\imkrmig.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-textservicesframework-migration-dl\msctfmig.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-textservicesframework-migration-dl\tabletextservicemig.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-unimodem-config\modemmigplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-winsock-core-infrastructure-upgrade\wsupgrade.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\microsoft-windows-wmi-core\wmimigrationplugin.dll	0%	ReversingLabs
\Device\CdRom0\sources\dlmanifests\networking-mpssvc-svc\icfupgd.dll	0%	ReversingLabs
\Device\CdRom0\sources\du.dll	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\acres.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\actionqueue.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\appraiser.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\appraiserwc.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\arunres.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\cmisetup.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\compatctrl.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\compatresources.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\compres.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\dism.exe.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\dismapi.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\dismcore.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\dismprov.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\folderprovider.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\imagingprovider.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\input.dll.mui	0%	ReversingLabs
\Device\CdRom0\sources\en-gb\logprovider.dll.mui	0%	ReversingLabs

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
240.221.184.93.in-addr.arpa	1%	Virustotal	Browse
103.169.127.40.in-addr.arpa	1%	Virustotal	Browse
157.123.68.40.in-addr.arpa	1%	Virustotal	Browse
26.35.223.20.in-addr.arpa	1%	Virustotal	Browse
198.187.3.20.in-addr.arpa	1%	Virustotal	Browse
95.221.229.192.in-addr.arpa	1%	Virustotal	Browse
2.36.159.162.in-addr.arpa	0%	Virustotal	Browse
146.78.124.51.in-addr.arpa	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://schema.org/WebPage	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://www.virustotal.com/vtapi/v2/ip-address/report?ip=%s&apikey=%s	0%	Avira URL Cloud	safe
https://www.mitec.cz	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/ip-address/report?ip=%s&apikey=%s	0%	Virustotal		Browse
https://www.mitec.cz	0%	Virustotal		Browse
http://www.galapagosdesign.com/staff/dennis.htm=	0%	Virustotal		Browse
http://www.galapagosdesign.com/staff/dennis.htm=	0%	Avira URL Cloud	safe
http://www.google.com9~2	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/url/scan	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/gws/other-hp	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/gws/other-hp	0%	Virustotal		Browse
https://www.virustotal.com/vtapi/v2/url/scan	0%	Virustotal		Browse
http://madExcept.comU	0%	Avira URL Cloud	safe
http://www.google.com/E	0%	Avira URL Cloud	safe
https://www.mitec.cz0	0%	Avira URL Cloud	safe
http://www.google.com/A	0%	Avira URL Cloud	safe
https://www.mitec.czopenS	0%	Avira URL Cloud	safe
http://www.google.comU	0%	Avira URL Cloud	safe
http://www.typography.net	0%	Avira URL Cloud	safe
http://www.google.com/l	0%	Avira URL Cloud	safe
http://www.google.com	0%	Avira URL Cloud	safe
http://www.google.com/A	0%	Virustotal		Browse
http://www.google.com/E	0%	Virustotal		Browse
http://www.ascendercorp.com/typedesigners.html	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/file/report	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/file/scan	0%	Avira URL Cloud	safe
http://www.google.com	0%	Virustotal		Browse
http://www.google.com/l	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/domain/report?domain=%s&apikey=%s	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html	0%	Virustotal		Browse
https://www.virustotal.com/vtapi/v2/file/rescanU	0%	Avira URL Cloud	safe
http://www.typography.net	0%	Virustotal		Browse
http://www.google.com/z	0%	Avira URL Cloud	safe
https://www.mitec.cz/tmx.html#Pricing	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/file/report	0%	Virustotal		Browse
http://www.google.com/search?newwindow=1&q=%sopenU	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/file/scan	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://www.google.com/-	0%	Avira URL Cloud	safe
https://www.mitec.cz/webupdate.html	0%	Avira URL Cloud	safe
http://www.mitec.cz/exe.htmlopenU	0%	Avira URL Cloud	safe
https://www.virustotal.com/vtapi/v2/url/report	0%	Avira URL Cloud	safe
http://www.typography.netl	0%	Avira URL Cloud	safe
http://www.google.com/	0%	Avira URL Cloud	safe
http://www.typography.neti	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
www.google.com	172.217.23.100	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
23.149.64.172.in-addr.arpa	unknown	unknown	true		unknown
233.38.18.104.in-addr.arpa	unknown	unknown	true		unknown
103.169.127.40.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
240.221.184.93.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
157.123.68.40.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
168.100.16.2.in-addr.arpa	unknown	unknown	true		unknown
26.35.223.20.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
108.211.229.192.in-addr.arpa	unknown	unknown	true		unknown
68.32.126.40.in-addr.arpa	unknown	unknown	true		unknown
95.221.229.192.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
172.214.232.199.in-addr.arpa	unknown	unknown	true		unknown
32.162.222.173.in-addr.arpa	unknown	unknown	true		unknown
3.61.159.162.in-addr.arpa	unknown	unknown	true		unknown
2.36.159.162.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown
100.23.217.172.in-addr.arpa	unknown	unknown	true		unknown
146.78.124.51.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown
51.162.222.173.in-addr.arpa	unknown	unknown	true		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.virustotal.com/vtapi/v2/ip-address/report?ip=%s&apikey=%s	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.mitec.cz	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm=	TMX.exe, 00000000.00000003.1765606331.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765652198.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765531183.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com9~2	TMX.exe, 00000000.00000003.1864715936.00000000087CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	TMX.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	TMX.exe	false	URL Reputation: safe	unknown
https://www.virustotal.com/vtapi/v2/url/scan	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://csp.withgoogle.com/csp/gws/other-hp	TMX.exe, 00000000.00000003.1886157496.000000000876F000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1923928414.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://madExcept.comU	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	TMX.exe	false	URL Reputation: safe	unknown
https://www.mitec.cz0	TMX.exe	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com/E	TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.google.com/A	TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schema.org/WebPage	TMX.exe, 00000000.00000003.1923928414.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mitec.czopenS	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.comU	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.net	TMX.exe, 00000000.00000003.1753479626.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1753400342.00000000069E5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.google.com/l	TMX.exe, 00000000.00000003.1863921116.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3654782238.0000000008812000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1922586734.000000000880F000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1967410646.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.2007533311.000000000881A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com	TMX.exe, 00000000.00000003.1864715936.00000000087CE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.html	TMX.exe, 00000000.00000003.1765271807.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1764821428.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765198220.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1764735488.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765007498.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765313259.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765093780.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765386243.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765157921.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1765425389.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1764770433.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fonts.com	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.virustotal.com/vtapi/v2/file/report	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.virustotal.com/vtapi/v2/file/scan	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	TMX.exe, 00000000.00000003.1756858545.00000000069CA000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	TMX.exe	false	URL Reputation: safe	unknown
https://www.virustotal.com/vtapi/v2/domain/report?domain=%s&apikey=%s	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	TMX.exe	false	URL Reputation: safe	unknown
https://www.virustotal.com/vtapi/v2/file/rescanU	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/z	TMX.exe, 00000000.00000003.1863921116.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3654782238.0000000008812000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1922586734.000000000880F000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1967410646.000000000880E000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.2007533311.000000000881A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mitec.cz/tmx.html#Pricing	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp, TMX.exe, 00000000.00000002.3618921590.0000000003766000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com/search?newwindow=1&q=%sopenU	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	TMX.exe	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com/-	TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mitec.cz/webupdate.html	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp, TMX.exe, 00000000.00000002.3618921590.0000000003766000.00000004.00001000.00020000.00000000.sdmp, TMX.exe, 00000000.00000002.3607807663.00000000012D3000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	TMX.exe, 00000000.00000002.3646075844.0000000007BA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mitec.cz/exe.htmlopenU	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.virustotal.com/vtapi/v2/url/report	TMX.exe, 00000000.00000002.3579848936.0000000000A48000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netl	TMX.exe, 00000000.00000003.1753479626.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1753400342.00000000069E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/	TMX.exe, 00000000.00000003.1864715936.00000000086DB000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1923928414.0000000004D78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.neti	TMX.exe, 00000000.00000003.1753479626.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, TMX.exe, 00000000.00000003.1753400342.00000000069E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503269
Start date and time:	2024-09-03 09:29:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TMX.exe
Detection:	MAL
Classification:	mal42.troj.evad.winEXE@1/908@19/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	http://infokingz.com/wp-content/uploads/2024/09/Remittance-copy11.html	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	9fyoN350re.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
	661Ea5wCaX.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.therecoveryvillage.com/drug-addiction/signs-drug-addiction/	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.Inject5.8130.1270.16417.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://piclut.com/n//?c3Y9bzM2NV8xX29uZSZyYW5kPWRHcFdjMk09JnVpZD1VU0VSMjkwNzIwMjRVMTgwNzI5MDA=	Get hash	malicious	Unknown	Browse	192.229.221.95
	IrisQuentin530Victor.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	Book_0256103.vbe	Get hash	malicious	AgentTesla	Browse	192.229.221.95
	https://altanks.com.au/	Get hash	malicious	Unknown	Browse	192.229.221.95
bg.microsoft.map.fastly.net	IrisQuentin530Victor.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	tmp963289974.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://feji.us/y8jp4p	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://ggu-lop.vercel.app/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://pub-0047294bc4284f259967ae2863532e97.r2.dev/index.html	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://sso--coinbasepro---login--auth.webflow.io/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://secure---page--coinbase-walet--sso.webflow.io/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://responsibility0.glitch.me/public/.style.html	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://www.amazomx.com/	Get hash	malicious	Unknown	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
\Device\CdRom0\bootmgr.efi	5CG2133F5Y_2024-04-05_12_15_35.569.zip	Get hash	malicious	Unknown	Browse
\Device\CdRom0\bootmgr	5CG2133F5Y_2024-04-05_12_15_35.569.zip	Get hash	malicious	Unknown	Browse

Process:	C:\Users\user\Desktop\TMX.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1318 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	6884
Entropy (8bit):	3.3520280239601608
Encrypted:	false
SSDEEP:	96:262X44AX7cyfWOMeVbT30EMGUbrGTyeglE16O8t746Efv3VfANNWuyfJ:9bfnLbT3/xU2+Xur6WqNWus
MD5:	77D343425FC0193684A5085B19A597B6
SHA1:	96218E71424827AEE4425BB75E889833414695D3
SHA-256:	E932F7D66E9FB3159C4992E67EA1D6A9A82258CF1A917B6BDA0C08447757E2C9
SHA-512:	B5926BB814CD54DDB7D9C76301AC0F644AE13428F35B732E91A3A72EB0CB11D563B974C973EBB673639F8DB727F696F1FBC6DB3CD6F27C01F8A83C594CC8039C
Malicious:	false
Reputation:	low
Preview:	.........................F......L..................................p...4.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......d...................l.......4.......................................................................\...........................................................................4...........`...............................................................................................................................................................................,...............................................................................................................................$...............................................................................t...........................................................................................................................................................................................................................................................................................

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.982722957169909
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TMX.exe
File size:	4'610'952 bytes
MD5:	c3ac80cb293b407a4f4065c9fa978b97
SHA1:	9ebb9bc726023abe689bfdf5d7e7be5193896771
SHA256:	a4b87f426a36ea97a0f437eea63774f7949fc1f24d293ab9bd79b77fb8355e5b
SHA512:	70b184dbbe99caa3b0c7c25cddbd139314c511c0c6875cb862cf32a15d4f7726c0d202011266377369afd5cc508631d7d07f39ee419ea38ec2069b421153af70
SSDEEP:	98304:fHv6YtCyTPLi1kVsjgHtl6NTHF8wVBHsY3cjzOZLkNVFv:YyTrV7HtlqlrVBHsY3cPOZLQVB
TLSH:	8726337FC18098E4C45A58F81B47C8C1929B51626071EFAA6B0F77C0E1FDBC9645E3EA
File Content Preview:	MZ..............@.......@................................................(.................@.......!..L.!.......5qgHiPVIAuMGcQy/rRqVip+RCApn9ZO2w+Ly8E1CDyR5LJm+5uf7CGUwB7h2bjW80sC/WBv+oKWLcWw2NBj6tPtAyhwGhKRF60B=$..........................................

Entrypoint:	0xe49000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x667E8502 [Fri Jun 28 09:40:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0267b1c2c2f8c084a732df41ad1c1773

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TMX.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\INF\c_monitor.PNF

C:\Windows\INF\c_processor.PNF

C:\Windows\INF\c_volume.PNF

\Device\CdRom0\autorun.inf

\Device\CdRom0\boot\bcd

\Device\CdRom0\boot\boot.sdi

\Device\CdRom0\boot\bootfix.bin

\Device\CdRom0\boot\bootsect.exe

\Device\CdRom0\boot\en-gb\bootsect.exe.mui

\Device\CdRom0\boot\etfsboot.com

\Device\CdRom0\boot\fonts\chs_boot.ttf

\Device\CdRom0\boot\fonts\cht_boot.ttf

\Device\CdRom0\boot\fonts\jpn_boot.ttf

\Device\CdRom0\boot\fonts\kor_boot.ttf

\Device\CdRom0\boot\fonts\malgun_boot.ttf

\Device\CdRom0\boot\fonts\malgun_console.ttf

\Device\CdRom0\boot\fonts\malgunn_boot.ttf

\Device\CdRom0\boot\fonts\meiryo_boot.ttf

Windows Analysis Report
TMX.exe

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	21/02/2022 00:00:00 20/02/2025 23:59:59
Subject Chain	CN=ing. Michal Mutl, O=ing. Michal Mutl, S="Praha, Hlavn\xed m\u011bsto", C=CZ
Version:	3
Thumbprint MD5:	25F54ABF16EC79C193F385341BDFA0B3
Thumbprint SHA-1:	ACEEBDADAF8E139C5B5B62A835440BED74747EDF
Thumbprint SHA-256:	F2443BF7493DFEC3958C203997FFFE350CA80A7BD52BC39DA9BEB941D5DE3DF5
Serial:	7FB2DC3C0F1D43E1D1FE625E055C1480

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cc000	0x164
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8cd000	0x17a234	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x462e40	0x2d48
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa48680	0x10
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa48000	0x18
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x8c0000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_READ
	0x8c1000	0x6dfa	0x6e00	6005eaec5dab3a0a772038f6dd91d58e	False	0.23678977272727272	data	5.017057577047592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x8c8000	0x4000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ
	0x8cc000	0x1000	0x200	cbae1998e4a959df702e9471fc563fa6	False	0.388671875	data	2.8207790808514375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8cd000	0x17a234	0x92924	0b3747930b5a13cbff09f0502e09fa88	False	0.7098271692129337	data	7.655796284408263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0xa48000	0x1000	0x800	ac5b915600228c1661c3add1c04b0f48	False	0.0224609375	data	0.09468455378427074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xa49000	0x18000	0x17cd5	36ddc903fd8fe94a2a28c3b142594334	False	0.9994050854933175	DOS executable (COM)	7.996625635372898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
VCLSTYLE	0xa293ec	0x1de46	empty	English	United States	0
RT_CURSOR	0xa292b8	0x134	empty	English	United States	0
RT_CURSOR	0xa29184	0x134	empty	English	United States	0
RT_CURSOR	0xa29050	0x134	empty	English	United States	0
RT_CURSOR	0xa28f1c	0x134	empty	English	United States	0
RT_CURSOR	0xa28de8	0x134	empty	English	United States	0
RT_CURSOR	0xa28cb4	0x134	empty	English	United States	0
RT_CURSOR	0xa28b80	0x134	empty	English	United States	0
RT_CURSOR	0xa28894	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa285a8	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa282bc	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa27fd0	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa27e9c	0x134	empty	German	Germany	0
RT_CURSOR	0xa27d68	0x134	empty			0
RT_CURSOR	0xa27c34	0x134	empty	English	United States	0
RT_CURSOR	0xa27b00	0x134	empty	German	Germany	0
RT_CURSOR	0xa27814	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa27528	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa2723c	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa26f50	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa26c64	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa26978	0x2ec	empty	German	Germany	0
RT_CURSOR	0xa26844	0x134	empty	English	United States	0
RT_BITMAP	0xa2675c	0xe8	empty	English	United States	0
RT_BITMAP	0xa260f4	0x668	empty	English	United States	0
RT_BITMAP	0xa25a8c	0x668	empty	English	United States	0
RT_BITMAP	0xa25424	0x668	empty	English	United States	0
RT_BITMAP	0xa24dbc	0x668	empty	English	United States	0
RT_BITMAP	0xa24cac	0x110	empty	English	United States	0
RT_BITMAP	0xa24b9c	0x110	empty	English	United States	0
RT_BITMAP	0xa24534	0x668	empty	English	United States	0
RT_BITMAP	0xa23ecc	0x668	empty	English	United States	0
RT_BITMAP	0xa23864	0x668	empty	English	United States	0
RT_BITMAP	0xa235fc	0x268	empty			0
RT_BITMAP	0xa23394	0x268	empty			0
RT_BITMAP	0xa2312c	0x268	empty			0
RT_BITMAP	0xa23008	0x124	empty			0
RT_BITMAP	0xa22ee4	0x124	empty			0
RT_ICON	0x8ce29c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.150093808630394
RT_ICON	0x8cf36c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3129432624113475
RT_ICON	0x8cf7fc	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.1386094674556213
RT_ICON	0x8d128c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.325
RT_ICON	0x8d196c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.12717842323651452
RT_ICON	0x8d3f3c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2786885245901639
RT_ICON	0x8d48ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.07699574870099198
RT_ICON	0x8d8b3c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1801125703564728
RT_ICON	0x8d9c0c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3129432624113475
RT_ICON	0x8da09c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2786885245901639
RT_ICON	0x8daa4c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.150093808630394
RT_ICON	0x8dbb1c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.12717842323651452
RT_ICON	0x8de0ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.07699574870099198
RT_DIALOG	0xa22e90	0x52	empty			0
RT_DIALOG	0xa22e3c	0x52	empty			0
RT_STRING	0xa22cfc	0x140	empty			0
RT_STRING	0xa22c1c	0xe0	empty			0
RT_STRING	0xa22b2c	0xf0	empty			0
RT_STRING	0xa229a4	0x188	empty			0
RT_STRING	0xa224dc	0x4c8	empty			0
RT_STRING	0xa21f6c	0x570	empty			0
RT_STRING	0xa21af4	0x478	empty			0
RT_STRING	0xa217dc	0x318	empty			0
RT_STRING	0xa213ac	0x430	empty			0
RT_STRING	0xa20e0c	0x5a0	empty			0
RT_STRING	0xa20464	0x9a8	empty			0
RT_STRING	0xa1fa40	0xa24	empty			0
RT_STRING	0xa1f5f4	0x44c	empty			0
RT_STRING	0xa1f0d4	0x520	empty			0
RT_STRING	0xa1ec74	0x460	empty			0
RT_STRING	0xa1e84c	0x428	empty			0
RT_STRING	0xa1e488	0x3c4	empty			0
RT_STRING	0xa1e074	0x414	empty			0
RT_STRING	0xa1dc68	0x40c	empty			0
RT_STRING	0xa1d954	0x314	empty			0
RT_STRING	0xa1d624	0x330	empty			0
RT_STRING	0xa1d1b8	0x46c	empty			0
RT_STRING	0xa1cd28	0x490	empty			0
RT_STRING	0xa1c9dc	0x34c	empty			0
RT_STRING	0xa1c940	0x9c	empty			0
RT_STRING	0xa1c7f4	0x14c	empty			0
RT_STRING	0xa1c6c8	0x12c	empty			0
RT_STRING	0xa1c2ac	0x41c	empty			0
RT_STRING	0xa1be78	0x434	empty			0
RT_STRING	0xa1bacc	0x3ac	empty			0
RT_STRING	0xa1b5d0	0x4fc	empty			0
RT_STRING	0xa1b10c	0x4c4	empty			0
RT_STRING	0xa1aef4	0x218	empty			0
RT_STRING	0xa1aa68	0x48c	empty			0
RT_STRING	0xa1a808	0x260	empty			0
RT_STRING	0xa1a704	0x104	empty			0
RT_STRING	0xa1a5ec	0x118	empty			0
RT_STRING	0xa1a4b4	0x138	empty			0
RT_STRING	0xa1a358	0x15c	empty			0
RT_STRING	0xa1a1b8	0x1a0	empty			0
RT_STRING	0xa1a030	0x188	empty			0
RT_STRING	0xa19f14	0x11c	empty			0
RT_STRING	0xa19de0	0x134	empty			0
RT_STRING	0xa19988	0x458	empty			0
RT_STRING	0xa19384	0x604	empty			0
RT_STRING	0xa18f00	0x484	empty			0
RT_STRING	0xa18a94	0x46c	empty			0
RT_STRING	0xa1876c	0x328	empty			0
RT_STRING	0xa18440	0x32c	empty			0
RT_STRING	0xa18028	0x418	empty			0
RT_STRING	0xa17d38	0x2f0	empty			0
RT_STRING	0xa17c78	0xc0	empty			0
RT_STRING	0xa17bdc	0x9c	empty			0
RT_STRING	0xa17898	0x344	empty			0
RT_STRING	0xa17408	0x490	empty			0
RT_STRING	0xa17140	0x2c8	empty			0
RT_STRING	0xa16e50	0x2f0	empty			0
RT_STRING	0xa16ac4	0x38c	empty			0
RT_RCDATA	0x8e30bc	0xd5d	data	English	United States	1.0032154340836013
RT_RCDATA	0x8e3e44	0xd57	data	English	United States	1.003221083455344
RT_RCDATA	0x8e4bc4	0xcfc	data	English	United States	1.003309265944645
RT_RCDATA	0x8e58e8	0xcd9	data	English	United States	1.0033444816053512
RT_RCDATA	0x8e65ec	0xd5d	data	English	United States	1.0032154340836013
RT_RCDATA	0x8e7374	0xd57	data	English	United States	1.003221083455344
RT_RCDATA	0x8e80f4	0xc4e	data	English	United States	1.0034920634920634
RT_RCDATA	0x8e8d6c	0xc4e	data	English	United States	1.0034920634920634
RT_RCDATA	0x8e99e4	0xcb5	data	English	United States	1.0033814940055334
RT_RCDATA	0x8ea6c4	0xcb0	data	English	United States	1.0033866995073892
RT_RCDATA	0x8eb39c	0xd56	data	English	United States	1.0032220269478618
RT_RCDATA	0x8ec11c	0xd47	data	English	United States	1.0032362459546926
RT_RCDATA	0x8ece8c	0xdc2	data	English	United States	1.0031232254400908
RT_RCDATA	0x8edc78	0xdc5	data	English	United States	1.0031205673758865
RT_RCDATA	0x8eea68	0xcf3	data	English	United States	1.003318250377074
RT_RCDATA	0x8ef784	0xced	data	English	United States	1.0033242671501965
RT_RCDATA	0x8f049c	0xda9	data	English	United States	1.0031455533314269
RT_RCDATA	0x8f1270	0xda6	data	English	United States	1.0031482541499714
RT_RCDATA	0x8f2040	0xcf3	data	English	United States	1.003318250377074
RT_RCDATA	0x8f2d5c	0xced	data	English	United States	1.0033242671501965
RT_RCDATA	0x8f3a74	0x10	data			1.5625
RT_RCDATA	0xa091e0	0xd8e2	empty	English	United States	0
RT_RCDATA	0x8f3ad4	0x148b	data	English	United States	1.0020916524054002
RT_RCDATA	0x8f4f88	0x111e	data	English	United States	1.0025102692834322
RT_RCDATA	0x8f60d0	0xd8c	data	English	United States	1.0031718569780854
RT_RCDATA	0x8f6e84	0x4	data	English	United States	3.0
RT_RCDATA	0x8f6eb0	0x62be	data	English	United States	1.0006329614684706
RT_RCDATA	0xa01714	0x7ac9	empty			0
RT_RCDATA	0xa012d4	0x43e	empty			0
RT_RCDATA	0x9f9ef4	0x73de	empty			0
RT_RCDATA	0x9f9c00	0x2f3	empty			0
RT_RCDATA	0x9f9950	0x2ae	empty			0
RT_RCDATA	0x9f82f4	0x165a	empty			0
RT_RCDATA	0x9f5070	0x3282	empty			0
RT_RCDATA	0x9f3cc4	0x13ab	empty			0
RT_RCDATA	0x9f27b4	0x150f	empty			0
RT_RCDATA	0x9b11ec	0x415c8	empty	English	United States	0
RT_RCDATA	0x9ab26c	0x5f80	empty	English	United States	0
RT_RCDATA	0x9aa278	0xff4	empty			0
RT_RCDATA	0x99f488	0xadef	empty			0
RT_RCDATA	0x99e498	0xfee	empty			0
RT_RCDATA	0x99c4ac	0x1fec	empty			0
RT_RCDATA	0x93f698	0x5ce12	data			0.9731939509884303
RT_RCDATA	0x93da48	0x1c4e	data			0.9831631244824731
RT_RCDATA	0x93d73c	0x309	MySQL table definition file Version 15, type GEMINI, MySQL version 1467955708			1.0141570141570142
RT_RCDATA	0x9392d4	0x4468	data			0.8253768844221105
RT_RCDATA	0x936b6c	0x2768	data			0.9932593180015861
RT_RCDATA	0x918254	0x1e918	data			0.9479106766340809
RT_RCDATA	0x91496c	0x38e7	data			0.991213015720464
RT_RCDATA	0x9141fc	0x76d	data			1.0057864281956865
RT_RCDATA	0x9127d4	0x1a25	data			0.9910354101299865
RT_RCDATA	0x912098	0x739	data	English	United States	1.005949161709032
RT_RCDATA	0x91195c	0x739	data	English	United States	1.005949161709032
RT_RCDATA	0x910cd4	0xc88	data	English	United States	0.9996882793017456
RT_RCDATA	0x91004c	0xc88	data	English	United States	1.003428927680798
RT_RCDATA	0x90c6dc	0x3970	data	English	United States	0.9922470076169749
RT_RCDATA	0x8fd620	0x333d	data	English	United States	1.0008386063886558
RT_RCDATA	0x900988	0x4d4e	data	English	United States	1.0008084891359272
RT_RCDATA	0x905700	0xe43	data	English	United States	1.0030128731854286
RT_RCDATA	0x90656c	0xbc3	data	English	United States	1.0036532713384259
RT_RCDATA	0x907158	0xc58	data	English	United States	1.0034810126582279
RT_RCDATA	0x907dd8	0xbd1	data	English	United States	1.0036363636363637
RT_RCDATA	0x9089d4	0xcfa	data	English	United States	1.0033112582781456
RT_RCDATA	0x90b560	0x117c	OpenPGP Secret Key	English	United States	0.9908400357462019
RT_RCDATA	0x90a9a0	0xbbf	data			1.0036581310276023
RT_RCDATA	0x909748	0x124	data			1.0376712328767124
RT_GROUP_CURSOR	0x90a98c	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x90a978	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x90a964	0x14	data			1.4
RT_GROUP_CURSOR	0x90a950	0x14	data			1.45
RT_GROUP_CURSOR	0x90a93c	0x14	data			1.45
RT_GROUP_CURSOR	0x90a928	0x14	data			1.45
RT_GROUP_CURSOR	0x90a914	0x14	OpenPGP Public Key			1.45
RT_GROUP_CURSOR	0x90a900	0x14	data			1.45
RT_GROUP_CURSOR	0x90a8ec	0x14	data			1.45
RT_GROUP_CURSOR	0x90a8d8	0x14	data			1.45
RT_GROUP_CURSOR	0x90a8c4	0x14	data			1.45
RT_GROUP_CURSOR	0x90a8b0	0x14	data			1.45
RT_GROUP_CURSOR	0x90a89c	0x14	data			1.45
RT_GROUP_CURSOR	0x90a888	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x90a874	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x90a860	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x90a84c	0x14	data	English	United States	1.4
RT_GROUP_CURSOR	0x90a838	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x90a824	0x14	data	English	United States	1.4
RT_GROUP_CURSOR	0x90a810	0x14	COM executable for DOS	English	United States	1.45
RT_GROUP_ICON	0x909c7c	0xbc	data	English	United States	0.5159574468085106
RT_VERSION	0x909d78	0x34c	data	English	United States	0.4834123222748815
RT_MANIFEST	0x90a104	0x70b	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.403771491957848

DLL	Import
kernel32.dll	GetModuleHandleW
user32.dll	SetWindowTextW
advapi32.dll	OpenBackupEventLogW
comctl32.dll	ImageList_Write

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2024 09:30:54.021665096 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.026607037 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.026722908 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.026947021 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.031959057 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.698936939 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.698956966 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.698968887 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.698980093 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.698992968 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.698993921 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.699003935 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.699016094 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.699024916 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.699035883 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.699047089 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.699048996 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.699057102 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.699080944 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.699094057 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.699131012 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.704010963 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.704052925 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.704057932 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.704094887 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.704174995 CEST	80	49739	172.217.23.100	192.168.2.4
Sep 3, 2024 09:30:54.704240084 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.717513084 CEST	49739	80	192.168.2.4	172.217.23.100
Sep 3, 2024 09:30:54.717534065 CEST	49739	80	192.168.2.4	172.217.23.100

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2024 09:30:53.409436941 CEST	55408	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.414642096 CEST	64696	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.416606903 CEST	56280	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.420444965 CEST	49970	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.422111034 CEST	59790	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.422285080 CEST	53	64696	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.423614979 CEST	53	56280	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.424189091 CEST	63110	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.425012112 CEST	61890	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.425538063 CEST	53	49976	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.427983046 CEST	53	49970	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.428093910 CEST	61323	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:53.428477049 CEST	53	55408	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.429625988 CEST	53	59790	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.430871964 CEST	53	63110	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.438107967 CEST	53	61323	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:53.454243898 CEST	53	61890	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:54.010363102 CEST	54540	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:54.017282009 CEST	53	54540	1.1.1.1	192.168.2.4
Sep 3, 2024 09:30:54.605679989 CEST	60112	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:30:54.613634109 CEST	53	60112	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:01.654782057 CEST	59371	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:01.662106991 CEST	53	59371	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:02.589668989 CEST	58695	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:02.589965105 CEST	52049	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:02.597183943 CEST	53	58695	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:02.599189043 CEST	53	52049	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:03.411197901 CEST	60662	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:03.412225962 CEST	57904	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:03.419547081 CEST	53	60662	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:03.420631886 CEST	53	57904	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:17.290184021 CEST	53	64929	162.159.36.2	192.168.2.4
Sep 3, 2024 09:31:17.835503101 CEST	49906	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:17.845235109 CEST	53	49906	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:19.025532007 CEST	58521	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:19.033078909 CEST	53	58521	1.1.1.1	192.168.2.4
Sep 3, 2024 09:31:22.848862886 CEST	52349	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:31:22.855932951 CEST	53	52349	1.1.1.1	192.168.2.4
Sep 3, 2024 09:32:03.625118971 CEST	51484	53	192.168.2.4	1.1.1.1
Sep 3, 2024 09:32:03.632476091 CEST	53	51484	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Sep 3, 2024 09:30:54.026947021 CEST	58	OUT	GET / HTTP/1.1 User-Agent: test Host: www.google.com
Sep 3, 2024 09:30:54.698936939 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 03 Sep 2024 07:30:54 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=ISO-8859-1 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-vbU3dGCMndtiA-BZuiebxw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AVYB7cqoDAQYxFPbxxRfqWwZnoGl4JVx4L8Eev9U4AdRS9dNdccvBRwlHQ; expires=Sun, 02-Mar-2025 07:30:54 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=517=fY90xxN5VxsB6VP1LWE-W7zgNUAL7qJ0WkimI2pVwZJIAw8BcAjQvDg5PlDv1Iz879HDj3-gHsibim5lAb-FFvcls_-7wK5YgyOk34KR-aQHRHpbjkWuaVAqF9RDp6p6OIRhi-_JlZ5qHSbXf12iFxawkOGljpu3qXGFrKDinM6LilxIq296iQQS; expires=Wed, 05-Mar-2025 07:30:54 GMT; path=/; domain=.google.com; HttpOnly Accept-Ranges: none Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 33 34 65 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d Data Ascii: 34e7<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and m
Sep 3, 2024 09:30:54.698956966 CEST	1236	IN	Data Raw: 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 Data Ascii: ore. Google has many special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/images/brandin
Sep 3, 2024 09:30:54.698968887 CEST	1236	IN	Data Raw: 2c 32 30 30 2c 31 2c 35 32 39 2c 31 38 30 35 2c 38 38 36 31 2c 31 31 38 34 2c 36 36 30 2c 31 37 32 38 2c 32 2c 31 2c 36 2c 38 34 39 2c 31 2c 31 2c 32 2c 33 2c 32 36 39 39 2c 36 32 39 2c 38 2c 33 34 34 2c 34 33 39 2c 31 30 36 2c 31 34 2c 31 33 34 Data Ascii: ,200,1,529,1805,8861,1184,660,1728,2,1,6,849,1,1,2,3,2699,629,8,344,439,106,14,1346,1472,736,1,310,113,136,2,362,2037,915,17,43,3,2,1,9,297,27,435,96,156,175,261,1,888,3,2,79,27,2,599,308,113,1182,63,1,156,351,788,305,82,124,19,217,4,38,752,1,
Sep 3, 2024 09:30:54.698980093 CEST	672	IN	Data Raw: 74 28 61 2c 62 2c 63 2c 64 2c 6b 29 7b 76 61 72 20 65 3d 22 22 3b 62 2e 73 65 61 72 63 68 28 22 26 65 69 3d 22 29 3d 3d 3d 2d 31 26 26 28 65 3d 22 26 65 69 3d 22 2b 70 28 64 29 2c 62 2e 73 65 61 72 63 68 28 22 26 6c 65 69 3d 22 29 3d 3d 3d 2d 31 Data Ascii: t(a,b,c,d,k){var e="";b.search("&ei=")===-1&&(e="&ei="+p(d),b.search("&lei=")===-1&&(d=q(d))&&(e+="&lei="+d));d="";var g=b.search("&cshid=")===-1&&a!=="slh",f=[];f.push(["zx",Date.now().toString()]);h._cshid&&g&&f.push(["cshid",h._cshid]);c=c(
Sep 3, 2024 09:30:54.698992968 CEST	1236	IN	Data Raw: 3b 67 6f 6f 67 6c 65 2e 6c 6f 67 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 62 3d 3d 3d 76 6f 69 64 20 30 3f 6c 3a 62 3b 72 65 74 75 72 6e 20 74 28 22 22 2c 61 2c 62 29 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 28 66 75 6e Data Ascii: ;google.logUrl=function(a,b){b=b===void 0?l:b;return t("",a,b)};}).call(this);(function(){google.y={};google.sy=[];var d;(d=google).x\|\|(d.x=function(a,b){if(a)var c=a.id;else{do c=Math.random();while(google.y[c])}google.y[c]=[a,b];return!1});v
Sep 3, 2024 09:30:54.699003935 CEST	1236	IN	Data Raw: 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 23 67 62 61 72 7b 68 65 69 67 68 74 3a 32 32 70 78 7d 23 67 75 73 65 72 7b 70 61 64 64 69 6e 67 2d 62 6f 74 Data Ascii: er{font-size:13px;padding-top:1px !important;}#gbar{height:22px}#guser{padding-bottom:7px !important;text-align:right}.gbh,.gbd{border-top:1px solid #c9d7f1;font-size:1px}.gbh{height:0;position:absolute;top:24px;width:100%}@media all{.gb1{heig
Sep 3, 2024 09:30:54.699016094 CEST	256	IN	Data Raw: 68 74 3a 33 30 70 78 7d 2e 6c 73 62 62 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 57 71 51 41 4e 62 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 6c 73 62 7b 62 61 63 6b Data Ascii: ht:30px}.lsbb{display:block}#WqQANb a{display:inline-block;margin:0 12px}.lsb{background:url(/images/nav_logo229.png) 0 -261px repeat-x;color:#000;border:none;cursor:pointer;height:30px;margin:0;outline:0;font:15px arial,sans-serif;vertical-al
Sep 3, 2024 09:30:54.699035883 CEST	1236	IN	Data Raw: 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 61 64 63 65 30 7d 2e 6c 73 74 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 76 62 55 33 64 47 43 4d 6e Data Ascii: active{background:#dadce0}.lst:focus{outline:none}</style><script nonce="vbU3dGCMndtiA-BZuiebxw">(function(){window.google.erd={jsr:1,bv:2070,de:true};var g=this\|\|self;var k,l=(k=g.mei)!=null?k:1,n,p=(n=g.sdo)!=null?n:!0,q=0,r,t=google.erd,v=
Sep 3, 2024 09:30:54.699048996 CEST	1236	IN	Data Raw: 38 38 26 26 28 63 3d 63 2e 73 75 62 73 74 72 28 30 2c 31 32 32 38 38 29 29 3b 61 3d 63 3b 6d 7c 7c 67 6f 6f 67 6c 65 2e 6c 6f 67 28 30 2c 22 22 2c 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 Data Ascii: 88&&(c=c.substr(0,12288));a=c;m\|\|google.log(0,"",a);return a};window.onerror=function(a,b,d,m,e){r!==a&&(a=e instanceof Error?e:Error(a),d===void 0\|\|"lineNumber"in a\|\|(a.lineNumber=d),b===void 0\|\|"fileName"in a\|\|(a.fileName=b),google.ml(a,!1,v
Sep 3, 2024 09:30:54.699094057 CEST	1236	IN	Data Raw: 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3f 74 61 62 3d 77 6f 22 3e 44 72 69 76 65 3c 2f 61 3e 20 3c 61 20 63 6c 61 73 73 3d 67 62 31 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 22 20 68 72 65 66 3d 22 68 Data Ascii: ve.google.com/?tab=wo">Drive</a> <a class=gb1 style="text-decoration:none" href="https://www.google.com/intl/en/about/products?tab=wh"><u>More</u> »</a></nobr></div><div id=guser width=100%><nobr><span id=gbn class=gbi></span><span id=gb
Sep 3, 2024 09:30:54.704010963 CEST	1236	IN	Data Raw: 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 73 22 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 33 32 70 78 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 22 3e 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 6c 73 74 22 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e Data Ascii: ><div class="ds" style="height:32px;margin:4px 0"><input class="lst" style="margin:0;padding:5px 8px 0 6px;vertical-align:top;color:#000" autocomplete="off" value="" title="Google Search" maxlength="2048" name="q" size="57"></div><br style="li

Target ID:	0
Start time:	03:30:40
Start date:	03/09/2024
Path:	C:\Users\user\Desktop\TMX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TMX.exe"
Imagebase:	0x9f0000
File size:	4'610'952 bytes
MD5 hash:	C3AC80CB293B407A4F4065C9FA978B97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_RedLineStealer_a7da40b7, Description: unknown, Source: 00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_d4b38e13, Description: unknown, Source: 00000000.00000002.3611897583.0000000001439000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000000.00000003.2007533311.000000000882E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_a7da40b7, Description: unknown, Source: 00000000.00000002.3616445614.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000000.00000003.1922586734.0000000008826000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000000.00000003.1967410646.0000000008826000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000000.00000002.3654782238.0000000008826000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000000.00000003.1928800347.000000000882D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000000.00000003.2039876701.000000000882E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre