Edit tour

Windows Analysis Report
e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Overview

General Information

Sample name:	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Analysis ID:	1581455
MD5:	95b7a7cbc0aff0215004c5a56ea5952c
SHA1:	a1fb08b02975ec4869bcaf387d09d0abcced27e9
SHA256:	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3cb33bac121d804c1d61
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe" MD5: 95B7A7CBC0AFF0215004C5A56EA5952C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["147.45.44.224:1912"], "Bot Id": "1488Traffer", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2972a:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2021957221.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe PID: 6504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe PID: 6504	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.7e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.7e0000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2972a:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T19:06:56.793573+0100	2043234	1	A Network Trojan was detected	147.45.44.224	1912	192.168.2.5	49704	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T19:06:56.344475+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:07:01.869278+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:07:05.487562+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:07:05.945907+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.44.224	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T19:07:04.027466+0100	2046056	1	A Network Trojan was detected	147.45.44.224	1912	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T19:06:56.344475+0100	2046045	1	A Network Trojan was detected	192.168.2.5	49704	147.45.44.224	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Malware Configuration Extractor: RedLine {"C2 url": ["147.45.44.224:1912"], "Bot Id": "1488Traffer", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Joe Sandbox ML: detected

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBwinload_prod.pdb source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2143251485.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h

0_2_06C59B78

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49704 -> 147.45.44.224:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49704 -> 147.45.44.224:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 147.45.44.224:1912 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 147.45.44.224:1912 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 147.45.44.224:1912

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 147.45.44.224:1912

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.224

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	String found in binary or memory: https://api.ip.sb/ip
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_011FDC74	0_2_011FDC74
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C56628	0_2_06C56628
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C55458	0_2_06C55458
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C57468	0_2_06C57468
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C55F30	0_2_06C55F30
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C54C80	0_2_06C54C80
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C53D58	0_2_06C53D58
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C55AB0	0_2_06C55AB0
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C57BC0	0_2_06C57BC0
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C58B88	0_2_06C58B88
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C59B78	0_2_06C59B78
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C55448	0_2_06C55448
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C515C0	0_2_06C515C0
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C515D0	0_2_06C515D0
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C543B0	0_2_06C543B0
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C581D0	0_2_06C581D0
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C51ED8	0_2_06C51ED8
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C51EE8	0_2_06C51EE8
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C55F23	0_2_06C55F23
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C54C70	0_2_06C54C70
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C53D48	0_2_06C53D48
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C59B68	0_2_06C59B68
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Code function: 0_2_06C58B78	0_2_06C58B78

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2143099671.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\000004B0\\OriginalFilename vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\040904B0\\OriginalFilename vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\080904B0\\OriginalFilename vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000000.2021986650.0000000000826000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Mutant created: NULL

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000304D000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003062000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBwinload_prod.pdb source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2143251485.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Memory allocated: 29C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Window / User API: threadDelayed 1453			Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Window / User API: threadDelayed 3824			Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe TID: 5544	Thread sleep time: -18446744073709540s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe TID: 3856	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2143251485.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2146174983.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2021957221.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe PID: 6504, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR]q
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR]qPn
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q%appdata%`,]qdC:\Users\user\AppData\Roaming`,]qdC:\Users\user\AppData\Roaming\Binance
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q&%localappdata%\Coinomi\Coinomi\walletsLR]q
Source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe PID: 6504, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2021957221.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe PID: 6504, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
147.45.44.224:1912	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
147.45.44.224:1912	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtabS	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.000000000318A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3ResponseD	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23Response	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe, 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.224	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581455
Start date and time:	2024-12-27 19:06:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 93 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Simulations

Behavior and APIs

Time	Type	Description
13:07:02	API Interceptor	29x Sleep call for process: e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.224	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	147.45.49.155
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	147.45.44.151
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	HOrW5twCLd.exe	Get hash	malicious	XenoRAT	Browse	147.45.69.75
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	147.45.44.224
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131
	Collapse.exe	Get hash	malicious	LummaC	Browse	147.45.47.81

Process:	C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.0826199033637005
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
File size:	307'712 bytes
MD5:	95b7a7cbc0aff0215004c5a56ea5952c
SHA1:	a1fb08b02975ec4869bcaf387d09d0abcced27e9
SHA256:	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3cb33bac121d804c1d61
SHA512:	97ac66de88cac709e37d59c8a388c18d69aa3422d275be3e28b92e87167bcd87a310125e7dca593fe1b66d2f826cb2e22b64d51eac07dc94981dcd123e906961
SSDEEP:	3072:5cZqf7D342p/0+mAAkygmgQEgHaB1fA0PuTVAtkxz53RAeqiOL2bBOA:5cZqf7DIOnwT2B1fA0GTV8krAL
TLSH:	AF645A5833E8C910DA7F4775D861D67093B0BC63A952E70B4FC4ACAB3D32740EA51AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x4302fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x302a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e304	0x2e400	7d2956fac6518c32a347aa215cb1625f	False	0.4751002956081081	data	6.187976174538073	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	a8cf3f8ff27a4a736ba8fb433d91107f	False	0.2380765556768559	data	2.615031395625776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	55f9eb3ef5d1fad739850bd7f59c3f20	False	0.041015625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4447058823529412
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T19:06:56.344475+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:06:56.344475+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:06:56.793573+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	147.45.44.224	1912	192.168.2.5	49704	TCP
2024-12-27T19:07:01.869278+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:07:04.027466+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	147.45.44.224	1912	192.168.2.5	49704	TCP
2024-12-27T19:07:05.487562+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.44.224	1912	TCP
2024-12-27T19:07:05.945907+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.44.224	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 19:06:54.733074903 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:06:54.852969885 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:06:54.853072882 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:06:54.860825062 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:06:54.980474949 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:06:56.172643900 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:06:56.219732046 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:06:56.344475031 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:06:56.464132071 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:06:56.793572903 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:06:56.844743013 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:01.869277954 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:01.988955021 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286315918 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286355019 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286411047 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286448956 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286484003 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286519051 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:02.286530018 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:02.286530018 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:02.286612988 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:03.904783964 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027466059 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027506113 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027535915 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027545929 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027586937 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027589083 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027616024 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027620077 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027642965 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027645111 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027672052 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027686119 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027695894 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027735949 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027765036 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027792931 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.027837992 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.027942896 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147464037 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147500992 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147556067 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147563934 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147583008 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147609949 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147624016 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147651911 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147658110 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147682905 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147684097 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147720098 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147768021 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147816896 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147864103 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147897959 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.147953033 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.147998095 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.148008108 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.148073912 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.148094893 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.148257971 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.188993931 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.189337015 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.269730091 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.269870996 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.269953966 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270068884 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270160913 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270256996 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270263910 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270323992 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270370007 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270441055 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270442009 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270525932 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270529032 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270562887 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270616055 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270643950 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270736933 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270765066 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270797014 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270807981 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270839930 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270888090 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270936966 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270936966 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.270963907 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.270967007 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271035910 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271040916 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271063089 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271121979 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271131992 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271172047 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271200895 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271234035 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271266937 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271294117 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271343946 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271354914 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271369934 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.271395922 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.271420002 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.311306000 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.311383963 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.311471939 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.389836073 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.389867067 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.389894962 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.389944077 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.389975071 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390023947 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390050888 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390105009 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.390191078 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390197992 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.390243053 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390309095 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.390369892 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390417099 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390481949 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.390486002 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390517950 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390625954 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390657902 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390728951 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390777111 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390820980 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.390922070 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391038895 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391088009 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391248941 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391298056 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391352892 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391402960 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391463041 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391547918 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391580105 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391700029 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391731024 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391798019 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391882896 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.391937017 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392044067 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392071009 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392194986 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392262936 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392450094 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392501116 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392633915 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392662048 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392725945 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392752886 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392781019 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392811060 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392838955 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.392865896 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393011093 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393038988 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393065929 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393093109 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393125057 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393208027 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393239975 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393289089 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393390894 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393418074 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393465996 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393493891 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393526077 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393573046 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393657923 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393703938 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393735886 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.393815994 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.416467905 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.416594028 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.431247950 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.431297064 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.431570053 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.431617975 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.511610985 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.511642933 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.511691093 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.511718035 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.511749983 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.511799097 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512062073 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512105942 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512171984 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512222052 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512314081 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512362957 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512429953 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512480974 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512630939 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512660027 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512686968 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512736082 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512763977 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512789965 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.512816906 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.521344900 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.521483898 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.536509991 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536542892 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536591053 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536640882 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536668062 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536701918 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536780119 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536808968 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536936998 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.536969900 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537087917 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537115097 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537197113 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537225008 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537256002 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537303925 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537334919 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537411928 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537516117 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537565947 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537616014 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537645102 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537832975 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537864923 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537952900 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.537985086 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538111925 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538140059 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538172007 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538223028 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538285017 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538362980 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538588047 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538615942 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538646936 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538696051 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538743019 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538830042 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538857937 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538891077 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.538975000 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539026976 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539053917 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539119959 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539146900 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539213896 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539375067 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539402962 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539433956 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539499044 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539526939 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539608955 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539674997 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.539735079 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.544743061 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.544863939 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.642409086 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642440081 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642492056 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642519951 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642554045 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642771006 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642821074 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642869949 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642915964 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642949104 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.642997026 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643105984 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643150091 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643203974 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643244982 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643276930 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643305063 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643366098 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643393993 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643502951 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643552065 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643703938 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643731117 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643832922 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643860102 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643908978 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.643944025 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644026995 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644053936 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644176960 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644206047 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644328117 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644356012 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644464016 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644529104 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644561052 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644608021 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644635916 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644664049 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644710064 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644737005 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644764900 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644790888 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644840002 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644866943 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644893885 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644922018 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644947052 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.644973993 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.645023108 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.645065069 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.645112991 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.645139933 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.645186901 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.653825045 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.653951883 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.664664030 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.664695024 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.664735079 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.664783001 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.664833069 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.664936066 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.664997101 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665066957 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665153027 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665232897 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665266037 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665343046 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665491104 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665539026 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665671110 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665699005 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665730953 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665777922 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665937901 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.665987015 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666131973 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666160107 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666275024 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666332960 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666378021 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666490078 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666594028 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666642904 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666717052 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666764021 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666807890 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666908979 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.666940928 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667009115 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667040110 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667102098 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667166948 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667217970 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667309999 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667351961 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667399883 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667428017 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667474031 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667521954 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667612076 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667639017 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667716026 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667743921 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667773962 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667845964 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667913914 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.667960882 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.668081999 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.668148041 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.671169996 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.671339989 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.773838043 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.773870945 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.773917913 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.773992062 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774020910 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774046898 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774116039 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774142027 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774168968 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774195910 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774228096 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774298906 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774411917 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774440050 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774553061 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774672985 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774763107 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774791002 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774921894 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.774950027 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775043011 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775068998 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775201082 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775228977 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775368929 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775409937 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775520086 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775568008 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775638103 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775685072 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775774002 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775801897 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775832891 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.775881052 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776009083 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776060104 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776174068 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776202917 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776232958 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776259899 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776308060 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776334047 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776360989 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776387930 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776434898 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776462078 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776493073 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776544094 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776573896 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776602030 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776704073 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776731968 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776757956 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.776788950 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.777252913 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.777417898 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.791191101 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791219950 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791248083 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791275978 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791342020 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791371107 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791428089 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791455030 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791502953 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791531086 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791562080 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791590929 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791637897 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791670084 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791718006 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791744947 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791775942 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791824102 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791906118 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.791932106 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792000055 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792110920 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792244911 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792294979 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792403936 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792598963 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792625904 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792656898 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792722940 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792752981 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792807102 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792834044 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792960882 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.792988062 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793076992 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793121099 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793154001 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793219090 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793250084 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793287992 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793339014 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793373108 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793557882 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793586016 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793636084 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793730974 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793781996 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793807983 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793838978 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793885946 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793934107 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793962002 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.793991089 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.794037104 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.794289112 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.794456005 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.897252083 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897284985 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897314072 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897341967 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897368908 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897397041 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897445917 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897474051 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897521019 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897550106 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897576094 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897602081 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897649050 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897676945 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897728920 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897756100 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897820950 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897849083 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897897959 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897926092 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897953033 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.897999048 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898025990 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898052931 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898099899 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898127079 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898154020 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898204088 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898231030 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898279905 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898308039 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898355961 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898382902 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898509979 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898536921 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898746967 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898775101 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898823977 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898850918 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898878098 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898927927 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898955107 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.898982048 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899008989 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899035931 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899085045 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899111032 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899137020 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899163008 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899214029 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899240971 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899288893 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899338007 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899384975 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.899679899 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:04.925457001 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.925502062 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.925532103 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.925559998 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:04.926860094 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021183968 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021270990 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021368027 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021397114 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021502972 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021694899 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021826029 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021853924 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021886110 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.021945000 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022001982 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022053957 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022145033 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022249937 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022281885 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022413015 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022444963 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022494078 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022578001 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022672892 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022754908 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022819996 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.022952080 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.023036957 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.023070097 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.023118019 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.486608028 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.487561941 CET	49704	1912	192.168.2.5	147.45.44.224
Dec 27, 2024 19:07:05.607332945 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.903846979 CET	1912	49704	147.45.44.224	192.168.2.5
Dec 27, 2024 19:07:05.945907116 CET	49704	1912	192.168.2.5	147.45.44.224

Target ID:	0
Start time:	13:06:53
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe"
Imagebase:	0x7e0000
File size:	307'712 bytes
MD5 hash:	95B7A7CBC0AFF0215004C5A56EA5952C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.2021957221.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2144376861.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2144376861.0000000002D69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	5

Executed Functions

Function 06C59B78 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06C59DC3
$]q, xrefs: 06C59DD9
$]q, xrefs: 06C59D13
$]q, xrefs: 06C59D29

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 12bfc04cdd9798565f926a598a625beb1ac51e36f4876954943762b3f72a0df3
Instruction ID: b739e09ea0a39e78975c1bd32f23632055809e68fca779b00ff67fc395af39ac
Opcode Fuzzy Hash: 12bfc04cdd9798565f926a598a625beb1ac51e36f4876954943762b3f72a0df3
Instruction Fuzzy Hash: 40C1E670E00258CFDB68DFA5C9907AEBBB2FF89300F5085A9D409AB354DB345A86CF54

Function 06C57BC0 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 06C57F2F
., xrefs: 06C57EB4

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: a7552dd761bd9c50e8f8da42e53693823df5987db9ea9531004317dbc238a823
Instruction ID: 52c2624c10fdb3ee7b60f477367f8b31a8a7beb80485e711e749e745ad04ee58
Opcode Fuzzy Hash: a7552dd761bd9c50e8f8da42e53693823df5987db9ea9531004317dbc238a823
Instruction Fuzzy Hash: E7D1B274E01218CFDB68DFA5C950B9DB7B2BF89304F6085AAC409AB354DB359E86CF50

Function 06C56628 Relevance: 1.9, Strings: 1, Instructions: 641
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 06C56A1B

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 97d8b0db47134957332f40b3af1c43d58c43615becc6340fd2558fb6bb4b0c84
Instruction ID: 09ee448eb70ae452826747e675651508382bc7862fd1d3059cc713c43c43e14b
Opcode Fuzzy Hash: 97d8b0db47134957332f40b3af1c43d58c43615becc6340fd2558fb6bb4b0c84
Instruction Fuzzy Hash: 8B426C70E00269CFDB54CF66C8407ADFBB2BF89300F5185AAD849BB250DB749A85CF94

Function 06C54C80 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49d4261675082f21820e80f4e0a662e9c98210837420ffa0c5296375e812c65
Instruction ID: 1e9e826e63a18678a78a2f585563a4daf58840c99f6a0b1bd9b2ffd02e534ea2
Opcode Fuzzy Hash: a49d4261675082f21820e80f4e0a662e9c98210837420ffa0c5296375e812c65
Instruction Fuzzy Hash: 0BF19F74E01229CFDB68DFA5C984BDDBBB2BB49300F5095AAD409AB350DB319E85CF50

Function 06C55458 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dde98bb1b8b6362039959a3c7f87bca0e372a3eea8c5177fb93b37343e444a8
Instruction ID: fa0a4cd632d56154501b6ae963d1d756cf89b6a1f872fd07b2cadf8aa295c44a
Opcode Fuzzy Hash: 6dde98bb1b8b6362039959a3c7f87bca0e372a3eea8c5177fb93b37343e444a8
Instruction Fuzzy Hash: 80E18074E00229CFDB64DFA5C890B9DBBB2FF89300F5081AAD549A7251DB355E86CF50

Function 06C57468 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b2481c6abd305f50e15d03665b245def6fa0ac1c9ceebd41eccd45f3082410
Instruction ID: 179171117c19f3f61d94336c2e4af2712d123951d8c244673deb13ff73b5c374
Opcode Fuzzy Hash: 18b2481c6abd305f50e15d03665b245def6fa0ac1c9ceebd41eccd45f3082410
Instruction Fuzzy Hash: C1E1C274E01229CFDB68DF65C894BADBBB2BF89300F5085AAD409A7350DB305E85CF51

Function 06C58B88 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa48f034bb709bbdd1cdc68146f40e529ea0bc88a2eb97ac8bb17409cd4fd62
Instruction ID: d59a9d7791256531578df9f8e06a94d22e9f5b871d6c7d1601dc556ef9a28de4
Opcode Fuzzy Hash: 3aa48f034bb709bbdd1cdc68146f40e529ea0bc88a2eb97ac8bb17409cd4fd62
Instruction Fuzzy Hash: DDD19274E01228CFDB64DFA9C984B9DBBF2BF49301F1091AAD809A7355DB309A85CF54

Function 06C53D58 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefe9cc5d413a9639cf5ab7b3cfcd14637b4aae30869698b6efb4f6cbfa56fdd
Instruction ID: 36d3b6cc5d1b30eb8eacd393fb958e2f555b1ffb8a15f2f3ee79051f7f92d1ff
Opcode Fuzzy Hash: aefe9cc5d413a9639cf5ab7b3cfcd14637b4aae30869698b6efb4f6cbfa56fdd
Instruction Fuzzy Hash: 54C1B174E012189FDB44DFA9D984AAEBBF2FF88300F209169E905A7355DB34AE45CF50

Function 06C55AB0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abee3de4e19296da73288eaba6e227cebca9969cf73e5a300e68aa3bdd9329d9
Instruction ID: a7cfc2f19de8e67f17632d76f786362b85d47334d3ea4d60b6a75dc8f9ec1843
Opcode Fuzzy Hash: abee3de4e19296da73288eaba6e227cebca9969cf73e5a300e68aa3bdd9329d9
Instruction Fuzzy Hash: 3FB1B274E01218CFDB68DFA5C944A9DBBB2FF89304F6081A9D409AB355DB359E86CF40

Function 06C53D48 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c4a70d6cf38e00c8d32357f074e04446637211a5fe4725235eaa9efe107467
Instruction ID: ff3ee6fe53f3f54f375e0e4d1cf3c7d5cfbd2c1458f46e9ff21c06ae4eb2be7e
Opcode Fuzzy Hash: 88c4a70d6cf38e00c8d32357f074e04446637211a5fe4725235eaa9efe107467
Instruction Fuzzy Hash: E1A1C474E012089FDB54CFA9D984AEEBBF2FF88300F209069E904AB355D734AA45CF54

Function 06C55F30 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a1134d50efb330302ec472f9bb9df863ee94ef8dbb17db9ef68e3459943d0f
Instruction ID: d1eb15273939716a5d4abeb45046f1f047090f0b49be6a4e0425f823736b6bb9
Opcode Fuzzy Hash: d9a1134d50efb330302ec472f9bb9df863ee94ef8dbb17db9ef68e3459943d0f
Instruction Fuzzy Hash: 87A1C174E01218CFDB58DFAAD944A9DBBF2BF89300F5090A9D809AB355DB319986CF44

Function 06C59B68 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b669a81683b4258a911bc140d78e0ca92b34f14eebf039b86d986c1b6aef1ceb
Instruction ID: 8956ccf607c27a45005044e82ff0dd6c96abd21892cc2fc2a1020c6e8d56836c
Opcode Fuzzy Hash: b669a81683b4258a911bc140d78e0ca92b34f14eebf039b86d986c1b6aef1ceb
Instruction Fuzzy Hash: 6A41D5B1E01649CBDB58DFAAC95069EBBF2BF89300F14C12AD819BB354DB345942CF45

Function 011FD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011FD136
GetCurrentThread.KERNEL32 ref: 011FD173
GetCurrentProcess.KERNEL32 ref: 011FD1B0
GetCurrentThreadId.KERNEL32 ref: 011FD209

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2740b02f15eede250d4ad7b755aaccd65f4b5e21c8b71e850944aac653b5e101
Instruction ID: 7e61ca41ba16c34c8073ea2575500dcab0de9070a807886f0820c06f82d6fb67
Opcode Fuzzy Hash: 2740b02f15eede250d4ad7b755aaccd65f4b5e21c8b71e850944aac653b5e101
Instruction Fuzzy Hash: F25157B09002498FDB08DFA9E549BAEBFF5EF48304F24C45DE119A73A0DB389944CB65

Function 011FD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011FD136
GetCurrentThread.KERNEL32 ref: 011FD173
GetCurrentProcess.KERNEL32 ref: 011FD1B0
GetCurrentThreadId.KERNEL32 ref: 011FD209

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fd7c13dd5e405d07fdd153707b52a27af2813341290302bdca8341a741fc26b4
Instruction ID: ecac92765ccad8c3518f37b0b4bc2afa87fd1016f22b1e42a9faf92f5d6f1273
Opcode Fuzzy Hash: fd7c13dd5e405d07fdd153707b52a27af2813341290302bdca8341a741fc26b4
Instruction Fuzzy Hash: 455158B09002098FDB18DFAAE548BAEBFF5EF48314F20C459E119A7360DB389944CF65

Function 06C56F96 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06C57062
$]q, xrefs: 06C57014

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 59759507973fd52a0aded33669eac8e8914221c88644e6d8fba5a30a5465b1f0
Instruction ID: 32d4a5589b3edc3cfeae59fc03e598f83b61dade61e3230df784565b582b3554
Opcode Fuzzy Hash: 59759507973fd52a0aded33669eac8e8914221c88644e6d8fba5a30a5465b1f0
Instruction Fuzzy Hash: 397126B1E00318AFDB10CF99C894BDEBFB5BF48300F048519E809AB250DB74A984CBA1

Function 06C502B0 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06C57062
$]q, xrefs: 06C57014

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 2e252a008a468e4b924088508c0d586a6be633ef1ef3213f6507708287eebc44
Instruction ID: cf39f722f2ab5a21bd0efbeda8b2ed20fac6163329a0cd6b329e6d5ab7ba1485
Opcode Fuzzy Hash: 2e252a008a468e4b924088508c0d586a6be633ef1ef3213f6507708287eebc44
Instruction Fuzzy Hash: 256107B1E00318AFDB14CF99C894ADEBFB5BF48300F054519E909AB340DB74A985CBA0

Function 06C5D05C Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 06C5D9DE
Haq, xrefs: 06C5D911

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 8e566e3c95a6a7402276884254fe3dc8df1fd66a0bdca793cf0ba85cddd82ceb
Instruction ID: 975db69271be474f6237011f2ed37852c02203e4b4b54696cd6bfa6991c1d2b4
Opcode Fuzzy Hash: 8e566e3c95a6a7402276884254fe3dc8df1fd66a0bdca793cf0ba85cddd82ceb
Instruction Fuzzy Hash: 2F41D630F043445FDB89EB7998215AF7FA6EFC1210F1545AED806D7381EE349E068395

Function 011FAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011FB086

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c5f81b30cd01aa159413674a20fb9bc902bbf7c0c58738671cf10b57f72810b2
Instruction ID: 69cde403b7acc7827ee29044ddab20e876317c42909812ee1dfad23c72a85c6e
Opcode Fuzzy Hash: c5f81b30cd01aa159413674a20fb9bc902bbf7c0c58738671cf10b57f72810b2
Instruction Fuzzy Hash: 417169B0A00B058FD728DF29E14075ABBF5FF88304F00892DE64ADBA51DB79E945CB91

Function 011F4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011F59F1

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e4d6b40a7e1cd962f25f63ecee5df40c121fa3bf6346c400b2f4d9dd6a0447dd
Instruction ID: 4c3ab452cefaaffc1c7cb09a2391d9ec984151d502569cdb70812b20de8db60e
Opcode Fuzzy Hash: e4d6b40a7e1cd962f25f63ecee5df40c121fa3bf6346c400b2f4d9dd6a0447dd
Instruction Fuzzy Hash: 3441E3B0C00719CBDB28DFA9C884B9DBBF6FF45304F20806AD508AB255DB756949CF91

Function 011F5935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011F59F1

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 47082e62cd5ac05f6e430e2fbaf87beb7c9d00a9bd941fa125cb7d9c865fa24c
Instruction ID: 0e134cea91db75189f069d60b8a7e85569706ec855d5f2f4a0e38a53afe577c6
Opcode Fuzzy Hash: 47082e62cd5ac05f6e430e2fbaf87beb7c9d00a9bd941fa125cb7d9c865fa24c
Instruction Fuzzy Hash: B44104B0C00719CEDB28CFA9C8847DDBBB6FF49304F24806AD508AB250DB75594ACF90

Function 011FD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011FD387

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7ffdb3c238159737e8fe7a95dee634c6a38af37b711f840ce6278fb1ac668d71
Instruction ID: 2217eed81c93af32f77ee7450ba0d3fd1372f7ca04ec7f34c38873ec5ef40b01
Opcode Fuzzy Hash: 7ffdb3c238159737e8fe7a95dee634c6a38af37b711f840ce6278fb1ac668d71
Instruction Fuzzy Hash: 2C21D5B59002489FDB10CF9AD984AEEFFF9FB48310F14841AE918A3350D379A954CFA5

Function 011FD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011FD387

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f4e095c20117388f4ff4c8edda631f1194e529e746ee0a2384bca5c17d363fea
Instruction ID: 720ead7363473ad003397b0af3087b8ac2e0095332c4b912e00c8a0d5de073ff
Opcode Fuzzy Hash: f4e095c20117388f4ff4c8edda631f1194e529e746ee0a2384bca5c17d363fea
Instruction Fuzzy Hash: DA21E4B5D002489FDB10CF9AD985AEEBBF5FB48310F14801AE918B3310D378A954CFA4

Function 011FB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011FB086

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ae2aae918eddea476093018b49f5ea937e61da0ae782126e76e653a4d688afc3
Instruction ID: 370dd72b7b3604927b89076f339efbee8510d771b55d3c0a080419f91f873f06
Opcode Fuzzy Hash: ae2aae918eddea476093018b49f5ea937e61da0ae782126e76e653a4d688afc3
Instruction Fuzzy Hash: 60110FB5C003498FDB24DF9AC444ADEFBF8AB88210F10841AD529B7210C379A545CFA5

Function 06C5FD48 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06C5FDA7

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 776d343eefe449fbf8862fc177fc0bd60d352dded8c8f48a01e8ee10e1b10505
Instruction ID: 92a1d66d14272a88af0c9aa9d9a913c259f6e43cb8977b4efb92b48f9ce57516
Opcode Fuzzy Hash: 776d343eefe449fbf8862fc177fc0bd60d352dded8c8f48a01e8ee10e1b10505
Instruction Fuzzy Hash: 4C31F274D00208DFDB58DFA9D948ADDBBF2AF88310F10902AE815B7350DB745985CFA8

Function 06C58FD7 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56837b1372eae6a72458ec4cb9bbfe4d623a91d35988fe748d77312bbaebd7cd
Instruction ID: 9acbc37fd2776862c48230f3a6a2f45759e39a764ca858690d8996c4f7a1c924
Opcode Fuzzy Hash: 56837b1372eae6a72458ec4cb9bbfe4d623a91d35988fe748d77312bbaebd7cd
Instruction Fuzzy Hash: 4381F670E00218DFDB19DFB5D991AAEBBB2FF88300F60806AD509AB355DA345D46CF50

Function 06C58FE8 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06ac3454da74a759c15e69a25c281237e2ca019757f0daab6d19d9263068bf2
Instruction ID: 277b02ca9100789a8dafd6b63ce6ef4d562aee1fe2cb9b23ab2a80e09451221d
Opcode Fuzzy Hash: b06ac3454da74a759c15e69a25c281237e2ca019757f0daab6d19d9263068bf2
Instruction Fuzzy Hash: 6B81E474E00218DFDB19DFB5D990AAEBBB2FF88300F60806AD50AAB355DA355D46CF50

Function 06C5A62F Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ccff76a556cc971c85e806729a2c4ccc5122a82a0dafa0f14554801b2f501e
Instruction ID: 8d647182fca957179d0582b22ce41a057dd9d8e2c2b51300f32928b432f8cdcb
Opcode Fuzzy Hash: 89ccff76a556cc971c85e806729a2c4ccc5122a82a0dafa0f14554801b2f501e
Instruction Fuzzy Hash: 4E410570D10308CBDB44EFB9C954ADDBBB2EF8A301F609629E406BB254EB745985CB45

Function 06C58048 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1b8b766b94472ec7867b37cfb1f7cec981881a9b3f4d54163f9be1a5e95f47
Instruction ID: 661978ebd41ebde5b68dbe02f5ea285a948f4a6ea15ffe1362a0869c2d794d8a
Opcode Fuzzy Hash: 1d1b8b766b94472ec7867b37cfb1f7cec981881a9b3f4d54163f9be1a5e95f47
Instruction Fuzzy Hash: 1C411874E01218DFCB54EFA4D8546EDBBB2EF89311F00842AE915B7291CB354A85CF94

Function 06C5A640 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ccde15a99613829c90164724fb36f2d11f6e80c94b31b4835e0d311cce3ea5
Instruction ID: 90cf4d3df00bef3b1c35847c35ff563b88c4dba84d35e7647e8b69c3eb3bd300
Opcode Fuzzy Hash: f1ccde15a99613829c90164724fb36f2d11f6e80c94b31b4835e0d311cce3ea5
Instruction Fuzzy Hash: 4F410574D10308CBDB44EFB9C954ADDBBB2FF8A301F209629E406BB254EB345985CB54

Function 06C595BC Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5c289dc616e5616d765bef2ddc6256aa56c633d8818bb2026798a4be8ead19
Instruction ID: ba3f9ee2861f207e23e92cc9dd91817f18b6bf1fb0e523b212eb6257407dc012
Opcode Fuzzy Hash: 8f5c289dc616e5616d765bef2ddc6256aa56c633d8818bb2026798a4be8ead19
Instruction Fuzzy Hash: 3031F571A003089FD750DFADD844AEEBFF9EF88310F148459E81AE3350DA38A945CBA5

Function 06C571F4 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f016ad121ef6cd18a6aab52dbe1aedace6568c3008f35bb24487f17a8b139c3
Instruction ID: 780bd85a61e15593159c77714f561de52194c53ad573df6a4ad1180391ee4190
Opcode Fuzzy Hash: 3f016ad121ef6cd18a6aab52dbe1aedace6568c3008f35bb24487f17a8b139c3
Instruction Fuzzy Hash: FB41F4B4D00248AFDB10CF99C984ADEBFF5EB48710F14801AE819AB250DB74A985CFA4

Function 06C502BC Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e16bdc1f493bfa887b952b55c18527821e59308f7b2d754d9b1608b332caec
Instruction ID: a4d2be5b96723d0ded8c72da476a29885c20c28317086bc38a183a1c4ac16bad
Opcode Fuzzy Hash: 87e16bdc1f493bfa887b952b55c18527821e59308f7b2d754d9b1608b332caec
Instruction Fuzzy Hash: 4F41E2B0D00248EFDB10CF99C994ADEBFF5EB48710F14841AE819AB250DB74A984CFA4

Function 06C5D76C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69cd613c1d7d94e17115eb18c4d4938b17dcdbb9e7d3b2d3052b8c1645cd0b8
Instruction ID: 3ace72e772b4bede62ad8881e20b8cb40cbd09a25343ab79872a7a65e1814a84
Opcode Fuzzy Hash: c69cd613c1d7d94e17115eb18c4d4938b17dcdbb9e7d3b2d3052b8c1645cd0b8
Instruction Fuzzy Hash: 4F41D2B1D00319DFDB10CFA9C984ADEBBB5BF48314F25802AD409BB210D7756A86CF95

Function 06C5D124 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be74d54a068479c799239efc3134b94dd1a9480a3230180ffaa88c3ee92ebb59
Instruction ID: 66991945724462a70d576bf0eebcea7bcc605dcb4f87832f92fe98bc33610524
Opcode Fuzzy Hash: be74d54a068479c799239efc3134b94dd1a9480a3230180ffaa88c3ee92ebb59
Instruction Fuzzy Hash: F441E2B1D00308DBDB20CFA9C984ADDBBB5FF48304F25802AD409BB210D7756A8ACF95

Function 06C58058 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9b12487761c0eb50393775099c58d3bc027277b89167c780d6edf938adcb6e
Instruction ID: 88fcbb5b9113696de23db04afd7ed311a4522a8481f0edc2d2bf3b3ea1fc108f
Opcode Fuzzy Hash: 9b9b12487761c0eb50393775099c58d3bc027277b89167c780d6edf938adcb6e
Instruction Fuzzy Hash: CA31E5B0E01208DFCB58EFA4D854AEDBBB2EF89311F108529E512B7290CB355A45CB94

Function 06C5D661 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a8368cae64246c9e1276b5890fc09c08e2e3775cf221d255f04f8263b24f39
Instruction ID: d273662b141cb42ee2122ec2e3acc12a24389519f85d059311dfafed84d264bf
Opcode Fuzzy Hash: 35a8368cae64246c9e1276b5890fc09c08e2e3775cf221d255f04f8263b24f39
Instruction Fuzzy Hash: 7731D630A003099FC704EF78D9408AEBBFAEF85304B1188A9D946DB351DF31EE048BA1

Function 06C5D670 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989656291c287a5518b4e70e822242a97e30c7017cdf1fb052651ef3359b8c42
Instruction ID: 38cca6e6fdc7aa52ac3d65c5c750eb72cf3a091abb7d6f0950fe53fe5e94b5f6
Opcode Fuzzy Hash: 989656291c287a5518b4e70e822242a97e30c7017cdf1fb052651ef3359b8c42
Instruction Fuzzy Hash: 7C21F2316043058FC715DF78D85489BBBFAEF85310B1588AAD54ADB351EF31E80ACB91

Function 06C595F4 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765ba42c40c38935e67feceb556eb2daf0356554c90a0fba939a23232baad3be
Instruction ID: bde99816874f572d2c1beb5510f0dad693d9a8a37a91b402de2ddcefc60e30fb
Opcode Fuzzy Hash: 765ba42c40c38935e67feceb556eb2daf0356554c90a0fba939a23232baad3be
Instruction Fuzzy Hash: FD21F631A04209AFCB45EF79DC458EE7FBAEFC6310B018466E915EB251DB30A909C795

Function 06C5EBC7 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6babeac4b1f61833d26c38e4a0fd4442cb93a51e6dbac4b4c7d13ff630cab4f
Instruction ID: 7095825fcb21811286b98cde66dcd40fbb315bbc6ec83a5a004ce92561ad8a2a
Opcode Fuzzy Hash: c6babeac4b1f61833d26c38e4a0fd4442cb93a51e6dbac4b4c7d13ff630cab4f
Instruction Fuzzy Hash: 6D21F6B18083948FCB11DFADD8546DABFF4EF0A310F15409BD494AB252D378A548CBA5

Function 00EFD774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143550943.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732a25075cafefd2af231f03fcb9c2c8e21b9aba787ad3d644a204f3f9ca0b80
Instruction ID: f9381114b2fe4c92da59d841953493ae3e7a071547a918e6925cd83cd218b588
Opcode Fuzzy Hash: 732a25075cafefd2af231f03fcb9c2c8e21b9aba787ad3d644a204f3f9ca0b80
Instruction Fuzzy Hash: DC212772508248DFCB099F14DDC0F26BF66FB88318F208569EA091A255C33AD815DBA1

Function 00EFD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143550943.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0262f1a92062422e6dec8779d7354071e0f0dbfab272f78e1b2cf9159f2b0990
Instruction ID: 11c1a2f10b01e8eada3eafb268a98f298a8acf711a631787bf98ee4ec1cfe733
Opcode Fuzzy Hash: 0262f1a92062422e6dec8779d7354071e0f0dbfab272f78e1b2cf9159f2b0990
Instruction Fuzzy Hash: D6210371508248DFCB05DF14D9C0F36BF66FB98318F20C569EA091B256C33AD816DAA2

Function 0111D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143672231.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_111d000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b5d7300c0d55372cbd41397efd04779c7d610661df972e4e0cdc33fc6cd7dc
Instruction ID: 620d7b9b2e11a22d8f338fee6e4641ed9255ac52b76976fcc1d9a2685f69e194
Opcode Fuzzy Hash: e6b5d7300c0d55372cbd41397efd04779c7d610661df972e4e0cdc33fc6cd7dc
Instruction Fuzzy Hash: A5210075604200DFCF19DF68E988B26FF65EB88314F20C5BDD90A0B25AC33AD406CA62

Function 06C5E361 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa293b80495b251ab33b6024393a4b56808e5421ed45117e4cc103c6bc2fcb3
Instruction ID: 59e5783fb0f06a50c6da8baac91d518024f4082ef5507d42a6558db3b1a57173
Opcode Fuzzy Hash: 8aa293b80495b251ab33b6024393a4b56808e5421ed45117e4cc103c6bc2fcb3
Instruction Fuzzy Hash: 9A11AC302003118FC718AF38D890A5A7BFAEF85354720497DD15A9B391DF36A906CB94

Function 06C56ED8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a002d43b11f52492dbfe4482a6cd9b701e0809c485509f5b7d2cb156a377c73
Instruction ID: bbbcb1c1643fd0e118d2ee29bb87a633162370554adc44922aa5194ce2cd6e31
Opcode Fuzzy Hash: 1a002d43b11f52492dbfe4482a6cd9b701e0809c485509f5b7d2cb156a377c73
Instruction Fuzzy Hash: 612107B5D012199FCB10CF9AD884BDEFBB4FB08310F10822AE918A7250D374A984CBA5

Function 06C5E370 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52af88eeca3edd5dd130dbe3e3fd28b80cb8fe71b19a1e3c90c4acb3c1e631c6
Instruction ID: ef263552b3bb9b4afd1b468183f37927eb58d6b55701aeec5d2889dec538038c
Opcode Fuzzy Hash: 52af88eeca3edd5dd130dbe3e3fd28b80cb8fe71b19a1e3c90c4acb3c1e631c6
Instruction Fuzzy Hash: 88116D303003158FD728EF79D494A5AB7EAFF84354B20893DD21A9B794DF36A906CB94

Function 00EFD76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143550943.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 8e73db5caf4641141d879826523441ff246204935f90a7277351241cc60f975e
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: 6521D272504284DFCB16CF10D9C4B26BF72FB98314F24C6A9DA491B256C33AD816DB91

Function 06C56EE0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963827b52170cc9ced831d38f0026cc11619b8e65c430f44dd885bfdb9b74b09
Instruction ID: f80c822a6fbaa78cac9c8a36828f22cf1c971991a227e9287b172e29c0b58d61
Opcode Fuzzy Hash: 963827b52170cc9ced831d38f0026cc11619b8e65c430f44dd885bfdb9b74b09
Instruction Fuzzy Hash: 9921C5B1D01259DFCB04DF9AD884BDEFBB4FB48314F50822AE918A7250D374A984CFA5

Function 06C5D55B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8caf003b9f123ffea709a38b6f97e91e0b1881bc8ba1074e910b3569576606eb
Instruction ID: 7a88fae05cf010b784f3ecf4a605fd1cff21496caeed2708df8d12307ea11bfb
Opcode Fuzzy Hash: 8caf003b9f123ffea709a38b6f97e91e0b1881bc8ba1074e910b3569576606eb
Instruction Fuzzy Hash: 6821E4B59003499FCB10DF9AD844ADEBFF4FF48324F54841AE919A7210C379A684CFA5

Function 06C5D050 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cbea0cb8d513f3a89a7788ad4ea4f9ede1fdbb53ccd4fd91ed5fd8e74663894
Instruction ID: 96a7023fe24b7250e01cc16360504fbe85a60efbda527a8da48c0ec6f1faae86
Opcode Fuzzy Hash: 3cbea0cb8d513f3a89a7788ad4ea4f9ede1fdbb53ccd4fd91ed5fd8e74663894
Instruction Fuzzy Hash: F62114B59003499FCB10DF9AD844ADEBFF4FF48310F50841AE919A7210C379AA84CFA9

Function 00EFD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143550943.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 25008e055cf35bd6450e670379f0dff71f546fadf7a058999e6f5bb75a37197d
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 23112972404244CFCF02CF10D9C4B26BF72FB94318F24C5A9D9450B256C336D45ADBA2

Function 0111D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143672231.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_111d000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: ffb686f9e80ca277671ef4a9440f304b356177e4873fa2bc8d4f4ba60932b932
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 4111D075504280CFDB16CF58E5C8B15FF61FB44314F24C6A9D8494B65AC33BD44ACB62

Function 06C55145 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be95c8dccacce65e04406e2ce3b0f8777a7d2d96bfd4442fdaaf202f5cb6a4cd
Instruction ID: f4d3e670dbbf7cbba03f0962119b696590e218bec86ccaa1990be1c3dde600fd
Opcode Fuzzy Hash: be95c8dccacce65e04406e2ce3b0f8777a7d2d96bfd4442fdaaf202f5cb6a4cd
Instruction Fuzzy Hash: 9711CE74D01219CFCB64CFA9C8846ECBBB5FF4A315F60606AD819B7241D7319986CF54

Function 06C54AC8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62cb1678e0cf7d9d76261cfa437001cda02dfa88e814405e157ee3d746ea9581
Instruction ID: 4500266b800fa9568ac5f67008d33834b54cd5221136bb89ecca8863022e3239
Opcode Fuzzy Hash: 62cb1678e0cf7d9d76261cfa437001cda02dfa88e814405e157ee3d746ea9581
Instruction Fuzzy Hash: 04114875E002199FCB15DFA8D8056EFBBB5EF48301F40406AD515A7341DA359941CBE1

Function 06C5EC40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3732231f820081cd986b7cee9eb1e6e70c49d6c1fef52926b0d87dd62a0a4d4d
Instruction ID: e5559d9d2a29cb9ac10e3bde4aafdbb05862b976aec560a80419aa296d4f0555
Opcode Fuzzy Hash: 3732231f820081cd986b7cee9eb1e6e70c49d6c1fef52926b0d87dd62a0a4d4d
Instruction Fuzzy Hash: AE1136B59002488FCB60DF9AD844BDEFBF8EB48310F108419E919A7340C379A984CFA4

Function 06C502C8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd54268d681522472c94652e1f3438d5a8134f1e32f53697b664e186f492a083
Instruction ID: 0f3b86f0e82725da772017c40981a296048b7566fce2b45e3f1c64ad9a4af798
Opcode Fuzzy Hash: fd54268d681522472c94652e1f3438d5a8134f1e32f53697b664e186f492a083
Instruction Fuzzy Hash: 4C1136B18003498FCB10DF9AD848BDEBBF8EB48320F108419D919A7240C378A984CFA4

Function 06C5FCA3 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9324025fd64ce8da4589c2e9ec59c832915715cc91fd8b373910352eee41318
Instruction ID: 2d3ad344165ce803399ddf4935685f99bb648fcd4acfb993267cd2b3697f686b
Opcode Fuzzy Hash: e9324025fd64ce8da4589c2e9ec59c832915715cc91fd8b373910352eee41318
Instruction Fuzzy Hash: B711F5B59002498FCB20DF9AD444BDEFBF8EB48320F14845AD559A7210C379A584CFA5

Function 06C57390 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404af3fd0985c458b3675cb2fb30ae34a90abbc13ae06c6bd920ff08f8472160
Instruction ID: 90d658fdb93bd95b6b6f0896fca3ac13b0545837242cc8315adb78072dd7cf6b
Opcode Fuzzy Hash: 404af3fd0985c458b3675cb2fb30ae34a90abbc13ae06c6bd920ff08f8472160
Instruction Fuzzy Hash: E11103B5900249CFCB10DF99D848BDEBBF4EF48324F20845AD959A7251C778A584CFA5

Function 00EFDA09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143550943.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57126fc1701508103994f7c98be929b39ac2466c64600227d9e6a9ef22c3e13c
Instruction ID: c29d8de70f6f838107fb3a1fd12ff8c04a152d73ef18f023642003a9d5e2f263
Opcode Fuzzy Hash: 57126fc1701508103994f7c98be929b39ac2466c64600227d9e6a9ef22c3e13c
Instruction Fuzzy Hash: 45012B3110C708DAD7208B6ACC84BB7BF9DEF45324F18D56AEE085B296C2799C40C679

Function 06C5D48B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef92407db00d681d410e596f77a48532db3f29bfb86c63269ffadd82811ed5d
Instruction ID: 6d8f8febf035c42cb1c9eb2d137b09f23442d1435c0c1a1d80e6862c09e39815
Opcode Fuzzy Hash: 4ef92407db00d681d410e596f77a48532db3f29bfb86c63269ffadd82811ed5d
Instruction Fuzzy Hash: 2AF0A431A042046FDB45DF69DC408AE7BBADFC4210705C066ED19DB365D730A901DB98

Function 06C54AD8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb2cb39a2438499c4309ced87b96494d7853ef2adc96e76415f8c02c620b875
Instruction ID: d632e1e3991ea58729b7237be9ac1081ab2246ea5b063d82734ea9bdcc1c72e2
Opcode Fuzzy Hash: bfb2cb39a2438499c4309ced87b96494d7853ef2adc96e76415f8c02c620b875
Instruction Fuzzy Hash: 84010575E002199BCF49EFA8D8516EEBBB1EF88301F40802AD115A7350DB359945CBD1

Function 06C5A801 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cd31cec923a4b7a569456e4f2c1ec2072d439b6a5e0135613be22f7d82958c
Instruction ID: 5bb470d5b5259dee0303bab158d7e245fc15bd6e0d21774f081fc24fadc03e83
Opcode Fuzzy Hash: 59cd31cec923a4b7a569456e4f2c1ec2072d439b6a5e0135613be22f7d82958c
Instruction Fuzzy Hash: 99F07A7A54E3D26FC3471B709C225C67FB49E6325171900D7D0C5CA5E3D25C05A9DBA2

Function 06C5DEBF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1454562ec07b372664f24d20c3b91ecd8c9ff07a8cbec7940415df717ae94206
Instruction ID: 55a37acc76b0c6cc26b997347f406406d98e1739cae3ec929316114e570b1cbb
Opcode Fuzzy Hash: 1454562ec07b372664f24d20c3b91ecd8c9ff07a8cbec7940415df717ae94206
Instruction Fuzzy Hash: 93F0E9725047125FC3541929AC048A6BBE8CE812303060176E86EC76A2E658AD87D7BD

Function 06C5818F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ece3e30c32d7496373d89e352675f2eed0aa4bab193c9ad8861cce3aa3f8e7
Instruction ID: 2d1bea968378f4575386ac356c5010a07a39b875859a54d02320638296a117f8
Opcode Fuzzy Hash: 97ece3e30c32d7496373d89e352675f2eed0aa4bab193c9ad8861cce3aa3f8e7
Instruction Fuzzy Hash: FE01ADB5D02118EFCB18CFA0E9405EDBB71EF85302F0140AAE920A7261CB308E51CB44

Function 06C5A108 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4bb0e528da68147643916cecf7243160e8707844ae347eca8a3064f7988971
Instruction ID: b713671496c7efc971f8a966d5b920c7ec24308f7057501441f74b1b33e48ade
Opcode Fuzzy Hash: 9c4bb0e528da68147643916cecf7243160e8707844ae347eca8a3064f7988971
Instruction Fuzzy Hash: D3015AB4C0424ACFCB15CFB4D4497AEBFB1AB0A312F1042AED811A7381E7384681CB85

Function 06C5A118 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f552068f7af5ffe2a525867e8655ccdb1499434c183fb10e02810e17c182b2
Instruction ID: 451666e22950b5a60f7113d1b678ecb730c4e73dfd25d3348aecd31e67a1beee
Opcode Fuzzy Hash: 89f552068f7af5ffe2a525867e8655ccdb1499434c183fb10e02810e17c182b2
Instruction Fuzzy Hash: BF0192B4D01209DFCB54DFB8D5496AEFFF0AB09341F10966A9915B3280E7788A81CF95

Function 00EFDA08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143550943.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9da16f9213722511e639bb76717cff50fc4b08d72d953d770db82d8bfa3766c
Instruction ID: ade5774979627bc5c88349e20ad798c6ba1e1e3eeee4d15e52454f0f58f8719f
Opcode Fuzzy Hash: e9da16f9213722511e639bb76717cff50fc4b08d72d953d770db82d8bfa3766c
Instruction Fuzzy Hash: 23F0F671008344DEE7208A0ADC84B62FFACEF51734F18C45AEE0C5B286C2799C44CAB4

Function 06C59B08 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b8b96884075c575e8a1dfb335d4117b2ec4f2ebf0d60244dd9bb110e58f4e8
Instruction ID: 62a0722159b0fb800deb8014e1373ddc501d759520346c60a5af6f464c5fe02b
Opcode Fuzzy Hash: 00b8b96884075c575e8a1dfb335d4117b2ec4f2ebf0d60244dd9bb110e58f4e8
Instruction Fuzzy Hash: BBF06D70C092089FC741FFB8D8055AEBFF4BB46300F448AAAD824A3291D7344A41CB95

Function 06C5A0A8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cba94958bf0b0ed1f3b0358b64339757a5e8fccf5a6afea79d20937cffc1bc
Instruction ID: f3b19f1610ed552cb8631182a2e1d29304cbed25bbeded01ed2f7ca19108d6ee
Opcode Fuzzy Hash: 76cba94958bf0b0ed1f3b0358b64339757a5e8fccf5a6afea79d20937cffc1bc
Instruction Fuzzy Hash: 47F0E2B1C002498FCB94EFB4E801AADBBB0EB42321F5046ADCC3027380D7354A82DBC5

Function 06C5D608 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f921c733c585adad3e28ed693008ec2702f8b1affd33cf2ae828f779a2e6d475
Instruction ID: 901e0abab903d608dcfdcdb64c6bb4bee6ab1d6ee29caae877502082d23e4ade
Opcode Fuzzy Hash: f921c733c585adad3e28ed693008ec2702f8b1affd33cf2ae828f779a2e6d475
Instruction Fuzzy Hash: 31F0A73090534AEFC705EFB4EA0195DBFF9EF0220472084E6D801D7255DB355E05CB61

Function 06C5EE50 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25a907fddf964adc02fb2895eac40b9ac13466c216ef64f318835a2a3291621
Instruction ID: b65e680384f125c7ebfcb5522187cdb25e64d156d4892ea3514d3cf878e87bcc
Opcode Fuzzy Hash: b25a907fddf964adc02fb2895eac40b9ac13466c216ef64f318835a2a3291621
Instruction Fuzzy Hash: 13F082742483C29FE701ABF0F4066557FB9FB46711F1154A6E9818B7C2DB784892CF21

Function 06C5E438 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af624323c2b66fda944dcd581e52c5425f058fa2d9b2d114ffb410b637fd7ce2
Instruction ID: e5acf75526b6db0a7d23f77d7c699577ec86d6cb96ba98a1ccd6abc3babd0597
Opcode Fuzzy Hash: af624323c2b66fda944dcd581e52c5425f058fa2d9b2d114ffb410b637fd7ce2
Instruction Fuzzy Hash: CFE04F357001109F57549A9FA88492AB7DEFBCE66036540BDE50DD7311DE22DC068690

Function 06C5A0B8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f3ac9b9462d8364e2f17637e10e6084e121ee076636864a49130d68fb67500
Instruction ID: 5a33f70ee05db7e5ef0540646a951159150db5b4ab816409065c3938cc753577
Opcode Fuzzy Hash: 78f3ac9b9462d8364e2f17637e10e6084e121ee076636864a49130d68fb67500
Instruction Fuzzy Hash: 42F0AC70D112199FCB84FFB8D8056ADBBB4FB45311F40896AD424A3240D7755651DB85

Function 06C59B18 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51353182b669256ec3744e80a3145f715a4d650483c1a3981322add0e971af15
Instruction ID: 9b8f94a0c89bf1184e926ad0dc4ff04a53152f7b95a86f9eedf4f8b225ad821c
Opcode Fuzzy Hash: 51353182b669256ec3744e80a3145f715a4d650483c1a3981322add0e971af15
Instruction Fuzzy Hash: 94F0F8B0D01208DFCB84EFB8D8055ADBBB0FB46300F5089AAD824A3240D7744A41CB85

Function 06C553FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c52ef13725d70134356309f197f0718ea18697999e59500eb4719772f44199
Instruction ID: 7572ae54f1aba75c11799bef55c8aa4cc6f0cf1ee18a0bf449d49e48966c57a8
Opcode Fuzzy Hash: 88c52ef13725d70134356309f197f0718ea18697999e59500eb4719772f44199
Instruction Fuzzy Hash: A3E06DB4D05308AFC751EFA8E84968CBFB0AB44301F5440EEE84483351E7309A98CB92

Function 06C55ED7 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0be218cb7e2a6003c8bb634b9ffdd58e50457f5ab05105757192f3d2dd4508c
Instruction ID: a24480b3cf867a54cbf96aa379d9ca60fe708d96d41a4fa5ad9d800e1f004aec
Opcode Fuzzy Hash: b0be218cb7e2a6003c8bb634b9ffdd58e50457f5ab05105757192f3d2dd4508c
Instruction Fuzzy Hash: 6FE01A74D11208AFC764DFA8E94DBD9BBF4AF04301F6081A99C09A7351E731AEA5CB91

Function 06C54C28 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb49ffdf841b4dd26d979ea52f2711beb45e3e83d5796a7cc14cc43c605b8035
Instruction ID: e4702144d53fecc930e230d923cce713dbf4568ac4dd279d11f4df81f2d9af46
Opcode Fuzzy Hash: eb49ffdf841b4dd26d979ea52f2711beb45e3e83d5796a7cc14cc43c605b8035
Instruction Fuzzy Hash: 83E06DB4809248AFC705DFB8E94968CBFB0EF05311F0440E9D84483252EB305AD4DBA2

Function 06C5FB09 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9addd503966423154a98be156339059a73448fa0818da2d6665528eaf8c86b2
Instruction ID: 335cc5fcddfafc7197c840beecdfff178a3538170eab07b42f507eb2be300ba1
Opcode Fuzzy Hash: f9addd503966423154a98be156339059a73448fa0818da2d6665528eaf8c86b2
Instruction Fuzzy Hash: 82D0973520C3630FC70A267858111E9BBFD8F0352070100B7D88AC7682CA844C4203EA

Function 06C5E033 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a3693f646e84f29b7db3f2da6eff35b3dce5236a196e2c3e7459c018407d57
Instruction ID: 3173bb3dd97ca80fb82ab2c055563269dfa39aac4a1bed4fdb9c12fdfa3a6fb9
Opcode Fuzzy Hash: a4a3693f646e84f29b7db3f2da6eff35b3dce5236a196e2c3e7459c018407d57
Instruction Fuzzy Hash: 04E0BF321052996BCB02AE94DC409DB3F299F4A260B158052F9544B152D2759E61DBE1

Function 06C5ED38 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac50d23d0d6d0e105e33ffc1495fd22591354c594cbb215cac8dd19e5c9c67e
Instruction ID: 19af9cfdff7e13c088aa20b736a0b283b8e265b35477a10227143d7dc295903e
Opcode Fuzzy Hash: 5ac50d23d0d6d0e105e33ffc1495fd22591354c594cbb215cac8dd19e5c9c67e
Instruction Fuzzy Hash: 20E08C7060A7419FD3758F38E800593BFF8FF0A21030209AAF4C2C3612D338E80A8B50

Function 06C595CC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552843c3d756941d1366a6dce26b5060dc248a18ac5e4cc571b6b03b579225a0
Instruction ID: 797e1af1858916baa9c8364b591a69cd8dad67d2993f168824bd5d7d70bd1ce3
Opcode Fuzzy Hash: 552843c3d756941d1366a6dce26b5060dc248a18ac5e4cc571b6b03b579225a0
Instruction Fuzzy Hash: EAE0E23214121DBB8B40AE85DC40DEB3F29EF89360B058416FE1557211C672E9A1ABE9

Function 06C5D618 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a424722c418f079cb36321417b95e3b5dc564139865f6c89602c5f0fb473bd6f
Instruction ID: fae4c423178c59adda1e810e4c5945ef1e2ad216ad2825e606999fd051a3af6c
Opcode Fuzzy Hash: a424722c418f079cb36321417b95e3b5dc564139865f6c89602c5f0fb473bd6f
Instruction Fuzzy Hash: F4E04F70A0020CEFC704EFA4EA4185CBBF9EB45304B1089A5D80597705DA326F009B51

Function 06C5EE60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bcc4f66af3d7f32ada759ad0c96f82946d7c9e50ca9b3450885a5207bb5ad1
Instruction ID: e65aacb596c79d553a8c7478f2c79bac219940041e6c6876819641a1f2f1396d
Opcode Fuzzy Hash: c0bcc4f66af3d7f32ada759ad0c96f82946d7c9e50ca9b3450885a5207bb5ad1
Instruction Fuzzy Hash: 3FE01A742403848FF700AF90F4067253B69F344B51F015869E9414BBC5CA799992CF21

Function 06C55A57 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5d266b4428a07786f7e546363912e2bad8929a2c67ed86b63aabae6e6ab526
Instruction ID: 3311e347f80129199a28e9ae47a07504fe22437aa321196d6ba9325752910826
Opcode Fuzzy Hash: bf5d266b4428a07786f7e546363912e2bad8929a2c67ed86b63aabae6e6ab526
Instruction Fuzzy Hash: B3E06570810208DFC724EFA8E98DAA8FBF0EB04314F5482AAD80883381E7309A91CB40

Function 06C55410 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0834d17bfe04c7550486df5d8381b235a1f97f3e51dd0138781add040cad9e
Instruction ID: 643fd3c57d669576cc34a56581da616c68183b8dfc180c7522b3e715188487e9
Opcode Fuzzy Hash: 9c0834d17bfe04c7550486df5d8381b235a1f97f3e51dd0138781add040cad9e
Instruction Fuzzy Hash: BCE0EC74D10208EFC744EFA8E54969CBBF4AB04301F5041A9E80893351E7309A94CB81

Function 06C55EE8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289ebeffc70eb124e6bb1a09aaed74afbad909a4e4974ad832c779de9a276675
Instruction ID: eef54028b53ecce2f0f8167e2973ec7e99c77396070b98c545bdda23c06db069
Opcode Fuzzy Hash: 289ebeffc70eb124e6bb1a09aaed74afbad909a4e4974ad832c779de9a276675
Instruction Fuzzy Hash: 32E0E274D10208EFCB44EFA8E949A9CBFF4AB08301F5081A99C0893391E7309A94CB81

Function 06C54C38 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0a450696f220f4fa9573a4a525f0ad341c4b078a34284c6fe98288594739e9
Instruction ID: 472a9fb2441314633a8fbfbf11ebc370d8688e7644d8a8b7ecfbc595c364bdff
Opcode Fuzzy Hash: fe0a450696f220f4fa9573a4a525f0ad341c4b078a34284c6fe98288594739e9
Instruction Fuzzy Hash: D0E0EC74D10208DFCB44EFA8E54969CBFF4AB04311F5081A9D80893351E7309A94DB81

Function 06C55A68 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16f65f93f8c3b81619d6d2c96f5cfb88390dde526ad1a1483f136edb456bf0b
Instruction ID: 6d345e03903e56ab12513323b9f25daf034bcfe4f1e5e376b1488458d12c20b2
Opcode Fuzzy Hash: a16f65f93f8c3b81619d6d2c96f5cfb88390dde526ad1a1483f136edb456bf0b
Instruction Fuzzy Hash: D1E0E274D10208EFCB44EFA8E989A9CBFF4AB08301F5081A99C0893351E7309A94CB91

Function 06C5E337 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ac676eba6dff27470a0bb489d5d4aa0769ad5d6c8eddefafb9d75e17e64e76
Instruction ID: 945ad76e597bf0dd8aca48afc533a26cf86209f3790be5abf3abdadbcd2f00fd
Opcode Fuzzy Hash: a5ac676eba6dff27470a0bb489d5d4aa0769ad5d6c8eddefafb9d75e17e64e76
Instruction Fuzzy Hash: 18D012710053809FCB168F3455541C13F755F4732473501CED0A489193C32A8547C7E1

Function 06C5A7BA Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc8c9a5119ff014f134990474b05a2f9464a46ee668b510c34f4ecba8f74dff
Instruction ID: 608a514b6f7f0fa7a5522a745c1eceead854ca9302df2572d5bb65c34b5a893a
Opcode Fuzzy Hash: ccc8c9a5119ff014f134990474b05a2f9464a46ee668b510c34f4ecba8f74dff
Instruction Fuzzy Hash: 82D09238E04248CFCF00CFD5E4444DCBBB8EB48310F000026D919AB208D2301954CF00

Function 06C5FB18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097510e8240d2c2bdebdc8c8a4c236f875d7b16aed90a5ab9bfeb618eb992f6c
Instruction ID: 4312bbfba6ea9097c66ea5e6a295513752cfc2ace35c41eb79667a32b2300c68
Opcode Fuzzy Hash: 097510e8240d2c2bdebdc8c8a4c236f875d7b16aed90a5ab9bfeb618eb992f6c
Instruction Fuzzy Hash: AFB09B3171423513D649319D68106BD738F4789565F450067A51D977419CC59D8103DE

Function 06C5D2F0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386104d9903d6a4677e9976925722fc864c94b1cd2985d71014ca64230aa2ed4
Instruction ID: 8e2be036a87d4010336168da76e636a3a2461daa3123fe551cdd3e22dfa160ff
Opcode Fuzzy Hash: 386104d9903d6a4677e9976925722fc864c94b1cd2985d71014ca64230aa2ed4
Instruction Fuzzy Hash: 20C080B04012019FEF189F18858C2143E54FF51318F3106CC502D891D2C739C587DBC5

Function 06C5958C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8bf103a93ac18d949c283cdf7f94108ee6e528a52adb885497037a51f342d9
Instruction ID: b970f7f7f081eeb909952c774dffbdc31e9d6c9dda2c3ebac4667795b85b3607
Opcode Fuzzy Hash: 5e8bf103a93ac18d949c283cdf7f94108ee6e528a52adb885497037a51f342d9
Instruction Fuzzy Hash: F2B012B62D4184F9E6C936A94DD8C2EAD04EFF2701F41AD623746400A1C43088BAF15F

Function 06C5E4DE Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372bb228cb0df43c90d1276ae7d0781901fe7878f4942c004a2875472fdb7731
Instruction ID: 54d7c6f4fdaba24e66e8d9d105bab4864baf7de31d717cc778e2a43aaf5561b7
Opcode Fuzzy Hash: 372bb228cb0df43c90d1276ae7d0781901fe7878f4942c004a2875472fdb7731
Instruction Fuzzy Hash: 029002445492C1146AC576354C140956B521EC610235990A054910451DCE115893B208

Non-executed Functions

Function 06C581D0 Relevance: 1.8, Strings: 1, Instructions: 528COMMON

Download Yara Rule

Strings

0o@p, xrefs: 06C58607

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: 0o@p
API String ID: 0-848860569
Opcode ID: f20f559aa8c17bc622885b3a7716bc674df74f228bf3b00a78dc065a92a69fb3
Instruction ID: 1bf1f44098d403acf869ec284c97bda69f051d88c6dc1766c6bd9b21fbb2b4d3
Opcode Fuzzy Hash: f20f559aa8c17bc622885b3a7716bc674df74f228bf3b00a78dc065a92a69fb3
Instruction Fuzzy Hash: 1C42AE74A012288FDB64DF65C894BEDBBB2FF49300F5085EAD509AB264DB349E85CF50

Function 06C515D0 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

Haq, xrefs: 06C516D0

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 6ca3b337980cc5efbed3118d36123019231f53c24f6c5a4c0600f5471a7386cc
Instruction ID: 0d1f3d6f47189164d293d2e129006d87c5f811fcd672bd8951c5bc07d2eebdb3
Opcode Fuzzy Hash: 6ca3b337980cc5efbed3118d36123019231f53c24f6c5a4c0600f5471a7386cc
Instruction Fuzzy Hash: B0E1C3B5E002288FDB54CFA9C884BEEBBF2FF89314F1491A9D419A7255D7309A85CF50

Function 06C515C0 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

Haq, xrefs: 06C516D0

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 7dac5e825d53542fcce049289c664e1d678bab13f39bec46f26c03bd15147de5
Instruction ID: 7dded5202ccc73fe54231fbdc8719742d31cdd57a5ab96eb27bcb3dfa1e31849
Opcode Fuzzy Hash: 7dac5e825d53542fcce049289c664e1d678bab13f39bec46f26c03bd15147de5
Instruction Fuzzy Hash: 9461E9B0D002298FDB54CF6AC844BEEFBF2BB88300F1885A9D418A7251D7745A85CF94

Function 06C51EE8 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93d7743ae08ed1f9f52bd01c93ec375f3d96b9f4ade9f811397431d0e369a15
Instruction ID: 144e38e10d79aba18ea30ef1db4373ab03067dc233ac0d2db94f25fa338d2b29
Opcode Fuzzy Hash: b93d7743ae08ed1f9f52bd01c93ec375f3d96b9f4ade9f811397431d0e369a15
Instruction Fuzzy Hash: 0892EB74A101158FC754DF68C990AAEB7F2FF88304F55C1A9D909AB74AC734EA81DF90

Function 06C51ED8 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b783a6fab699e48b83bdbd3eed54ee3e4fabda293221d07d5fb920b8e2ed7b9d
Instruction ID: 0bedabbe6e8e96c12f1d0348fbd30edc78d63523b2d0eff47c2c93b711dbb14f
Opcode Fuzzy Hash: b783a6fab699e48b83bdbd3eed54ee3e4fabda293221d07d5fb920b8e2ed7b9d
Instruction Fuzzy Hash: C232FC74A101258FD754DF68C990BAAB7F2FF88304F55C2A9D509AB74AC734EA81CF90

Function 011FDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144097999.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769512821fec3e31cda22c56f0a11c9d77ca10515b878089a0fbad05c0ad551e
Instruction ID: 85b3d7e8534285e1869c3277c5cb96392853608f5f5984524c0797ae5bf12136
Opcode Fuzzy Hash: 769512821fec3e31cda22c56f0a11c9d77ca10515b878089a0fbad05c0ad551e
Instruction Fuzzy Hash: 75A18136E002068FCF09DFB8D8445EEBBB2FF84304B15856EEA05AB265DB75D946CB50

Function 06C543B0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd06783f62052f3edfd536e0a6dca887119f80bd037e6b5c2ebaaa6ee2364feb
Instruction ID: 74850c4379b9036d94a0f1e1a9668acf0b7053333210d7185ca6ac0740e98042
Opcode Fuzzy Hash: bd06783f62052f3edfd536e0a6dca887119f80bd037e6b5c2ebaaa6ee2364feb
Instruction Fuzzy Hash: C3B1B474D012089FDB54CFA8C584A9EFBF2FF48351F56D1A9E814AB216C730EA85CB64

Function 06C55448 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209c8626fa9928ea2f7db8be21568b2cda8617becd17938174ce7328f3557e00
Instruction ID: ff44659edd7b6713c69805b46439fab4e6cf8b2ddd55d74aeb5f82039f039225
Opcode Fuzzy Hash: 209c8626fa9928ea2f7db8be21568b2cda8617becd17938174ce7328f3557e00
Instruction Fuzzy Hash: 7941ECB1E002189FDB68DF7AD8417DEBBF2AF89300F50C1AAD549A7251DB740A85CF51

Function 06C54C70 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1df2b16fae3ead825032553e87cec267d1636d711318f913dde2a98ec048947
Instruction ID: d887d4ed0e952a114c5fb141f3a2ae31bd7bf751db27caa677b035d28a9ca08b
Opcode Fuzzy Hash: a1df2b16fae3ead825032553e87cec267d1636d711318f913dde2a98ec048947
Instruction Fuzzy Hash: 2A41D5B1E002189BDB58DFAAD8447DEFBF2BF88300F54C16AD419AB255EB345985CF50

Function 06C55F23 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7563184b17c7950c4230f4ae22fe93cc4eb15c582d61e7942c99d7784f47ed
Instruction ID: bbc70d718ab57bf7c3486bf6f98033037d718982ddec722504d815055f9893e3
Opcode Fuzzy Hash: bb7563184b17c7950c4230f4ae22fe93cc4eb15c582d61e7942c99d7784f47ed
Instruction Fuzzy Hash: E331A571E012189BDB18DFABD9446DEBBF2AFC8300F14C13AD819AB255EB341946CF55

Function 06C58B78 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9970e70fd0167c255473a5095889841271c2f12abade6ba167dd68d7d99a57d0
Instruction ID: d1bc8a1ba7d9a8c3287a28cc8da9fb4c56106ec2e0ea70b957c21078cef0f287
Opcode Fuzzy Hash: 9970e70fd0167c255473a5095889841271c2f12abade6ba167dd68d7d99a57d0
Instruction Fuzzy Hash: 84317FB5E056188BEB18CFABD9405DEFBF7AFC8300F14D12AD919AB214EB305946CB54

Function 06C50C90 Relevance: 5.5, Strings: 4, Instructions: 465COMMON

Download Yara Rule

Strings

Haq, xrefs: 06C51060
Haq, xrefs: 06C50E6A
Haq, xrefs: 06C50EFC
`, xrefs: 06C50DD5

Memory Dump Source

Source File: 00000000.00000002.2151853154.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c50000_e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$`
API String ID: 0-2626186951
Opcode ID: a25ecebfda9a6dfcc13e774aa5febd24fcabfc90efa84c09d089f21b622dc4b5
Instruction ID: bb467653f56dfb27d338582db2dad8802b3e74e55557d4c3f28930fc386b05ce
Opcode Fuzzy Hash: a25ecebfda9a6dfcc13e774aa5febd24fcabfc90efa84c09d089f21b622dc4b5
Instruction Fuzzy Hash: 3A229474A00219CFDB54CFA9C984B9DBBF2BF49300F1185A9E809AB365D734AE85CF54

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe

Function 06C59B78 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Function 06C57BC0 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Function 06C56628 Relevance: 1.9, Strings: 1, Instructions: 641
COMMON

Function 011FD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 011FD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06C56F96 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Function 06C502B0 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Function 06C5D05C Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Function 011FAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 011F4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 011F5935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 011FD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 011FD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON