Edit tour

Windows Analysis Report
VmoLw6EKj5.exe

Overview

General Information

Sample name:	VmoLw6EKj5.exe renamed because original name is a hash value
Original sample name:	862f560eedeb50aea489b649e1c3790254a1d8424cc2bafde2c68e3dcd161967.exe
Analysis ID:	1588106
MD5:	77a55f762651be8698f5a33937e1e44f
SHA1:	4e1af4b0448b1fea39f5601654bd28c00bc29d83
SHA256:	862f560eedeb50aea489b649e1c3790254a1d8424cc2bafde2c68e3dcd161967
Tags:	exeRedLineStealeruser-adrian__luca
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

VmoLw6EKj5.exe (PID: 7388 cmdline: "C:\Users\user\Desktop\VmoLw6EKj5.exe" MD5: 77A55F762651BE8698F5A33937E1E44F)

VmoLw6EKj5.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\VmoLw6EKj5.exe" MD5: 77A55F762651BE8698F5A33937E1E44F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1343577808.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2578889800.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1343577808.0000000003E14000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VmoLw6EKj5.exe PID: 7388	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: VmoLw6EKj5.exe PID: 7388	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VmoLw6EKj5.exe PID: 7548	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.VmoLw6EKj5.exe.3da9990.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VmoLw6EKj5.exe.3da9990.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296be:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.VmoLw6EKj5.exe.4064588.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VmoLw6EKj5.exe.4064588.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296be:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
3.2.VmoLw6EKj5.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.VmoLw6EKj5.exe.400000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296be:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.VmoLw6EKj5.exe.4064588.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VmoLw6EKj5.exe.4064588.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x4a638:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x278be:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.VmoLw6EKj5.exe.3da9990.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VmoLw6EKj5.exe.3da9990.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x278be:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Click to see the 5 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: VmoLw6EKj5.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: VmoLw6EKj5.exe	Virustotal: Detection: 77%			Perma Link
Source: VmoLw6EKj5.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: VmoLw6EKj5.exe

Joe Sandbox ML: detected

Source: VmoLw6EKj5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: VmoLw6EKj5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb7 source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb\|b source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdbB$R source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001198000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbj+d source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.120.86:1912

Source: global traffic

TCP traffic: 192.168.2.11:49722 -> 87.120.120.86:1912

Source: global traffic

TCP traffic: 192.168.2.11:59973 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 87.120.120.86 87.120.120.86

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86

Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/H~
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LRgq0
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LRgqx
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LRgq(
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LRgql
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LRgqp
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LRgq4
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LRgqt
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LRgq8#
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LRgql
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LRgqt8
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LRgq0
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LRgql
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LRgq08
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LRgqxM
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LRgq(
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LRgqp-
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LRgq4
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LRgqx8
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LRgqC
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LRgq48
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LRgqX
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LRgqx
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LRgqD)
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LRgqPb
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LRgqX3
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LRgq4?
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LRgqt
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LRgqH
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LRgqH
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LRgqH
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LRgq(
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LRgqDd
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LRgqd
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LRgq8o
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LRgqh
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LRgqP
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LRgqp
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LRgq
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LRgq0
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LRgqx
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/x
Source: VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2578889800.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.VmoLw6EKj5.exe.3da9990.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.VmoLw6EKj5.exe.4064588.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 3.2.VmoLw6EKj5.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.VmoLw6EKj5.exe.4064588.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.VmoLw6EKj5.exe.3da9990.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_04AAD404	0_2_04AAD404
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07271E7A	0_2_07271E7A
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_072796C8	0_2_072796C8
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07272CF8	0_2_07272CF8
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07270B90	0_2_07270B90
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_072780A0	0_2_072780A0
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07274F00	0_2_07274F00
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07274F10	0_2_07274F10
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07279FBA	0_2_07279FBA
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07279FC8	0_2_07279FC8
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278E40	0_2_07278E40
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_072796B8	0_2_072796B8
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278688	0_2_07278688
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278698	0_2_07278698
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07273D08	0_2_07273D08
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_0727A560	0_2_0727A560
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_0727A570	0_2_0727A570
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_0727557A	0_2_0727557A
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07275588	0_2_07275588
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07271440	0_2_07271440
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07272CAD	0_2_07272CAD
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07272C96	0_2_07272C96
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07273CF8	0_2_07273CF8
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07270B3D	0_2_07270B3D
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07270B76	0_2_07270B76
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278348	0_2_07278348
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278358	0_2_07278358
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_072753A8	0_2_072753A8
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07275398	0_2_07275398
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278A80	0_2_07278A80
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278A90	0_2_07278A90
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07275108	0_2_07275108
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07275118	0_2_07275118
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_0727001F	0_2_0727001F
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07270040	0_2_07270040
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_07278090	0_2_07278090
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 0_2_072718D9	0_2_072718D9
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 3_2_010ADC74	3_2_010ADC74
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 3_2_0534EE58	3_2_0534EE58
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 3_2_05348850	3_2_05348850
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 3_2_05340006	3_2_05340006
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 3_2_05340040	3_2_05340040
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Code function: 3_2_05348840	3_2_05348840

Source: VmoLw6EKj5.exe, 00000000.00000002.1351971356.0000000005080000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000002.1352898849.0000000009F90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000003DEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000003DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000002.1338232370.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000000.00000000.1324413911.00000000001F8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegkkk.exe, vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe, 00000003.00000002.2578889800.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs VmoLw6EKj5.exe
Source: VmoLw6EKj5.exe	Binary or memory string: OriginalFilenamegkkk.exe, vs VmoLw6EKj5.exe

Source: VmoLw6EKj5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.VmoLw6EKj5.exe.3da9990.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.VmoLw6EKj5.exe.4064588.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 3.2.VmoLw6EKj5.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.VmoLw6EKj5.exe.4064588.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.VmoLw6EKj5.exe.3da9990.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: VmoLw6EKj5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VmoLw6EKj5.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Mutant created: NULL

Source: VmoLw6EKj5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VmoLw6EKj5.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VmoLw6EKj5.exe	Virustotal: Detection: 77%
Source: VmoLw6EKj5.exe	ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\VmoLw6EKj5.exe "C:\Users\user\Desktop\VmoLw6EKj5.exe"
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process created: C:\Users\user\Desktop\VmoLw6EKj5.exe "C:\Users\user\Desktop\VmoLw6EKj5.exe"
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process created: C:\Users\user\Desktop\VmoLw6EKj5.exe "C:\Users\user\Desktop\VmoLw6EKj5.exe"	Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: VmoLw6EKj5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: VmoLw6EKj5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb7 source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb\|b source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdbB$R source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001198000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbj+d source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.0000000001106000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Code function: 3_2_0534D442 push eax; ret

3_2_0534D451

Source: VmoLw6EKj5.exe

Static PE information: section name: .text entropy: 7.723046631687954

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: VmoLw6EKj5.exe PID: 7388, type: MEMORYSTR

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 2450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 25A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 45A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 73C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 83C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 8570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 9570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: A020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: B020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 10A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Memory allocated: 4D50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe TID: 7412

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: VmoLw6EKj5.exe, 00000003.00000002.2580049112.00000000011B6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Process created: C:\Users\user\Desktop\VmoLw6EKj5.exe "C:\Users\user\Desktop\VmoLw6EKj5.exe"

Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Users\user\Desktop\VmoLw6EKj5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Users\user\Desktop\VmoLw6EKj5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VmoLw6EKj5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\VmoLw6EKj5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.3da9990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.4064588.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.VmoLw6EKj5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.4064588.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.3da9990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1343577808.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2578889800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1343577808.0000000003E14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VmoLw6EKj5.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VmoLw6EKj5.exe PID: 7548, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.3da9990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.4064588.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.VmoLw6EKj5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.4064588.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VmoLw6EKj5.exe.3da9990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1343577808.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2578889800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1343577808.0000000003E14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VmoLw6EKj5.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VmoLw6EKj5.exe PID: 7548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
VmoLw6EKj5.exe	78%	Virustotal		Browse
VmoLw6EKj5.exe	71%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
VmoLw6EKj5.exe	100%	Avira	HEUR/AGEN.1305388
VmoLw6EKj5.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
87.120.120.86:1912	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
87.120.120.86:1912	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/Entity/Id14LRgqt8	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LRgq8o	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LRgqDd	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LRgqx	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18LRgqx8	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22LRgqPb	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15LRgql	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2LRgqH	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000000.00000002.1343577808.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2578889800.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LRgq0	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13LRgqt	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LRgqX	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LRgq0	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LRgqxM	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LRgqd	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LRgq(	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24LRgq4?	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17LRgq(	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LRgqH	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17LRgqp-	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LRgqP	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LRgq08	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24LRgqt	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LRgqp	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LRgqC	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22LRgqD)	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LRgql	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LRgq(	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LRgqx	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LRgqp	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LRgqx	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LRgq8#	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23LRgqX3	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/x	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4LRgqH	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LRgql	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/H~	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rmX	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3Response	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4LRgq	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E02000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LRgq48	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18LRgq4	VmoLw6EKj5.exe, 00000003.00000002.2580773385.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.120.86	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588106
Start date and time:	2025-01-10 21:25:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VmoLw6EKj5.exe renamed because original name is a hash value
Original Sample Name:	862f560eedeb50aea489b649e1c3790254a1d8424cc2bafde2c68e3dcd161967.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 42 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 2.23.242.162, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
15:26:12	API Interceptor	1x Sleep call for process: VmoLw6EKj5.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
87.120.120.86	Xf3rn1smZw.exe	Get hash	malicious	RedLine	Browse
	2eRd5imEKU.exe	Get hash	malicious	RedLine	Browse
	2eRd5imEKU.exe	Get hash	malicious	RedLine	Browse
	17.12.2024 ________.exe	Get hash	malicious	RedLine	Browse
	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Get hash	malicious	RedLine	Browse
	po4877383.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	QwMcsmYcxv.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	87.120.120.15
	QwMcsmYcxv.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	87.120.120.15
	Xf3rn1smZw.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	wqSmINeWgm.exe	Get hash	malicious	RedLine	Browse	87.120.120.7
	2eRd5imEKU.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	2eRd5imEKU.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Get hash	malicious	XWorm	Browse	87.120.116.179
	Material Requirments.pif.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	87.120.116.245
	Material requirements_1.pif.exe	Get hash	malicious	Remcos	Browse	87.120.116.245
	17363482243fcf48f1d103ef5a4702c871424ad69b9eb7d3f5e5957f5c4810f2a51fea8e76776.dat-decoded.exe	Get hash	malicious	XWorm	Browse	87.120.116.179

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VmoLw6EKj5.exe.log

Download File

Process:	C:\Users\user\Desktop\VmoLw6EKj5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.712894480833666
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	VmoLw6EKj5.exe
File size:	878'080 bytes
MD5:	77a55f762651be8698f5a33937e1e44f
SHA1:	4e1af4b0448b1fea39f5601654bd28c00bc29d83
SHA256:	862f560eedeb50aea489b649e1c3790254a1d8424cc2bafde2c68e3dcd161967
SHA512:	1f745e255872fd1bc468edf901e38fc441922c0827021f31ef17ca5825547be3a8ac6fc57edef0a8e64919d34aba96096f93cc822db1c89d28863fedc06e55f1
SSDEEP:	24576:jjlIhSPd+pOMFQQ9d6hIvhFlnY5ADSUmCfRq2dlgYSk1mS57elu:jjl+SPspAqdFvhztDHdfFr51ql
TLSH:	0815D0C03F2AB701DD6CB934853AEDB862592E64B00478F36EDD2B57B6D9112AE1CF44
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Zg..............0..L..........jj... ........@.. ....................................@................................

File Icon


Icon Hash:	32642092d4f29244

Static PE Info

General

Entrypoint:	0x4d6a6a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x675AA72E [Thu Dec 12 09:04:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd6a18	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd8000	0x14a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd4a70	0xd4c00	10901c35879ebd601c5c974dd13125b6	False	0.891717464747356	data	7.723046631687954	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd8000	0x14a8	0x1600	6ab3ad1e254e30c41e66b4bcf1ab21e2	False	0.36363636363636365	data	4.864802285696257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	8cd4a7b477e117e5708c8a495c9ebd26	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xd8118	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3726547842401501
RT_GROUP_ICON	0xd91c0	0x14	data	1.1
RT_GROUP_ICON	0xd91d4	0x14	data	1.05
RT_VERSION	0xd91e8	0x2c0	data	0.4588068181818182

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:26:16.058074951 CET	49722	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:16.062892914 CET	1912	49722	87.120.120.86	192.168.2.11
Jan 10, 2025 21:26:16.063004017 CET	49722	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:16.072931051 CET	49722	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:16.077712059 CET	1912	49722	87.120.120.86	192.168.2.11
Jan 10, 2025 21:26:37.450923920 CET	1912	49722	87.120.120.86	192.168.2.11
Jan 10, 2025 21:26:37.451034069 CET	49722	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:37.473685026 CET	49722	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:42.495800018 CET	49891	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:42.500797987 CET	1912	49891	87.120.120.86	192.168.2.11
Jan 10, 2025 21:26:42.500879049 CET	49891	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:42.501096010 CET	49891	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:26:42.505873919 CET	1912	49891	87.120.120.86	192.168.2.11
Jan 10, 2025 21:26:56.422487020 CET	59973	53	192.168.2.11	162.159.36.2
Jan 10, 2025 21:26:56.427357912 CET	53	59973	162.159.36.2	192.168.2.11
Jan 10, 2025 21:26:56.427478075 CET	59973	53	192.168.2.11	162.159.36.2
Jan 10, 2025 21:26:56.432276011 CET	53	59973	162.159.36.2	192.168.2.11
Jan 10, 2025 21:26:56.878834009 CET	59973	53	192.168.2.11	162.159.36.2
Jan 10, 2025 21:26:56.883913994 CET	53	59973	162.159.36.2	192.168.2.11
Jan 10, 2025 21:26:56.883977890 CET	59973	53	192.168.2.11	162.159.36.2
Jan 10, 2025 21:27:03.906424999 CET	1912	49891	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:03.906649113 CET	49891	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:03.906821966 CET	49891	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:08.916713953 CET	59983	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:08.921736956 CET	1912	59983	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:08.921830893 CET	59983	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:08.922059059 CET	59983	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:08.927027941 CET	1912	59983	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:30.315500975 CET	1912	59983	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:30.315591097 CET	59983	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:30.318043947 CET	59983	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:35.322925091 CET	59984	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:35.328166962 CET	1912	59984	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:35.328433990 CET	59984	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:35.328545094 CET	59984	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:35.333405018 CET	1912	59984	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:56.704277992 CET	1912	59984	87.120.120.86	192.168.2.11
Jan 10, 2025 21:27:56.704360962 CET	59984	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:27:56.704580069 CET	59984	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:28:01.713479996 CET	59985	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:28:01.718349934 CET	1912	59985	87.120.120.86	192.168.2.11
Jan 10, 2025 21:28:01.718436956 CET	59985	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:28:01.718684912 CET	59985	1912	192.168.2.11	87.120.120.86
Jan 10, 2025 21:28:01.723478079 CET	1912	59985	87.120.120.86	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:26:56.421895981 CET	53	63052	162.159.36.2	192.168.2.11
Jan 10, 2025 21:26:56.915229082 CET	53	54466	1.1.1.1	192.168.2.11

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: VmoLw6EKj5.exePID: 7388, Parent PID: 2592

General

Target ID:	0
Start time:	15:26:12
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\VmoLw6EKj5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VmoLw6EKj5.exe"
Imagebase:	0x120000
File size:	878'080 bytes
MD5 hash:	77A55F762651BE8698F5A33937E1E44F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1343577808.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1343577808.0000000004098000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1343577808.0000000003E14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: VmoLw6EKj5.exePID: 7548, Parent PID: 7388

General

Target ID:	3
Start time:	15:26:13
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\VmoLw6EKj5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VmoLw6EKj5.exe"
Imagebase:	0x9e0000
File size:	878'080 bytes
MD5 hash:	77A55F762651BE8698F5A33937E1E44F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2578889800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: VmoLw6EKj5.exePID: 7388, Parent PID: 2592COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	54
Total number of Limit Nodes:	6

Executed Functions

Function 07272C96 Relevance: 4.1, Strings: 3, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 07272FE2
ry, xrefs: 07272FCB
ry, xrefs: 07272FC4

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: 9076f670d47dd7609ec09a66b5ab2dfa55bb96f055c019241e32ff6fcaaaf31e
Instruction ID: 31c10e04e11a623cc282a0c8c7d575d2da5507b32abfdd156af22641eae27afe
Opcode Fuzzy Hash: 9076f670d47dd7609ec09a66b5ab2dfa55bb96f055c019241e32ff6fcaaaf31e
Instruction Fuzzy Hash: 9DD17DB5D2420ADFCB14CFA5D5858EEFBB2FF89340F148566D411AB219D734AA42CF90

Function 07272CAD Relevance: 4.1, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 07272FE2
ry, xrefs: 07272FCB
ry, xrefs: 07272FC4

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: 89722bff8d78c41f77be540ca9dbe193d691375d9468e15e154dd3a1cf8157ca
Instruction ID: 0f74b16ac904699b29fea25a62529d77b8321e8aa3c572da2f62251f3e169963
Opcode Fuzzy Hash: 89722bff8d78c41f77be540ca9dbe193d691375d9468e15e154dd3a1cf8157ca
Instruction Fuzzy Hash: AFD18CB5D2461ADFCB14CFA5D5858AEFBB2FF89340F148566D412AB218D334AA42CF90

Function 07272CF8 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 07272FE2
ry, xrefs: 07272FCB
ry, xrefs: 07272FC4

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: 9208111c994e17c6b155279e028cec657c7ea4824b1838625b49aeabe927658f
Instruction ID: 57225648dbee307f68eed11648cbcef919a590ea6b166d77e058f351615c0a87
Opcode Fuzzy Hash: 9208111c994e17c6b155279e028cec657c7ea4824b1838625b49aeabe927658f
Instruction Fuzzy Hash: 71C16CB5D2420ADFCB14CFA5C5858AEFBB2FF89340F10D559D416AB218D734AA82CF94

Function 07270B3D Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z^I, xrefs: 07270D51
Tegq, xrefs: 07270E00
Tegq, xrefs: 07270BF9

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: Tegq$Tegq$z^I
API String ID: 0-723423495
Opcode ID: d4e895d830c363a2f0c28dfd2f39fafa0fa0ec32f64a89adfd7e595f408774ea
Instruction ID: e1ccc6f30ecd5350988cee474ec0e9a098860dfa0e0f63399321159e5ebbd01e
Opcode Fuzzy Hash: d4e895d830c363a2f0c28dfd2f39fafa0fa0ec32f64a89adfd7e595f408774ea
Instruction Fuzzy Hash: 75A115B5E202098FCB18CFAAC984ADEFBB2FF89310F24902AD415AB254D7349945CF54

Function 07270B76 Relevance: 4.0, Strings: 3, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z^I, xrefs: 07270D51
Tegq, xrefs: 07270E00
Tegq, xrefs: 07270BF9

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: Tegq$Tegq$z^I
API String ID: 0-723423495
Opcode ID: ca943adea6a9f5197cac2d97f376adf115e89e930450f603ecd3a0322fb7a0b4
Instruction ID: 8b2f72d193ad8f54a230ec401f8ab4ec548a99cacb7dbe60e29acad29f255112
Opcode Fuzzy Hash: ca943adea6a9f5197cac2d97f376adf115e89e930450f603ecd3a0322fb7a0b4
Instruction Fuzzy Hash: 2491D2B4E202198FDB18CFAAC584ADEFBB2FF89310F24942AD415AB354D7349945CF54

Function 07270B90 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z^I, xrefs: 07270D51
Tegq, xrefs: 07270E00
Tegq, xrefs: 07270BF9

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: Tegq$Tegq$z^I
API String ID: 0-723423495
Opcode ID: 938b6ef3bc191a8ad5911a78c0a59f66c119a723f1041bccc99bf087d2d3132d
Instruction ID: 941ad34ca9ff46d99c3c78e418da30cf2598e665ccd80f54cfc2daa9b2d3c6eb
Opcode Fuzzy Hash: 938b6ef3bc191a8ad5911a78c0a59f66c119a723f1041bccc99bf087d2d3132d
Instruction Fuzzy Hash: 6D91D3B4E202198FCB18CFAAC5846AEFBB2FF89300F24942AD415BB354D7749945CF54

Function 072796C8 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TuA, xrefs: 07279838
UC;", xrefs: 072798B6

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: 034bc0049895c511bb55fde7c281e856ba78ec7710060f88dc8734a9f2269e03
Instruction ID: c3ffdfd9b8674e65c63bf53f399a041f3e2fe155368aaed9a4a16b1fa443ab81
Opcode Fuzzy Hash: 034bc0049895c511bb55fde7c281e856ba78ec7710060f88dc8734a9f2269e03
Instruction Fuzzy Hash: 79914AB5D25209DFCB08CFE6E58059EFBB2FF89350F10A42AE515AB264D734A942CF50

Function 072796B8 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TuA, xrefs: 07279838
UC;", xrefs: 072798B6

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: bc681b267f3537b9c80b3ff1dd89f22fb4eca3b155679ba3e26ce679c2ff2c51
Instruction ID: 2f2e411e3456e1f886239922ec1e10ad8ed9f873ca8d5a8c0f51d37c7d543917
Opcode Fuzzy Hash: bc681b267f3537b9c80b3ff1dd89f22fb4eca3b155679ba3e26ce679c2ff2c51
Instruction Fuzzy Hash: D5915BB1D25209EFCB08CFA5E5C059EFBB2FF89350F10A42AE515AB264D734A942CF50

Function 07278090 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

5=6, xrefs: 072781CE

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: e6d1b9f53e38c6440897e1d88537c266a30a8037908d3f4ee8c7ff563a70f232
Instruction ID: 66e2250e0dc1d41bf9ce21b02a21bd41b083c361a7deae6fe8b3fd0d72659dfd
Opcode Fuzzy Hash: e6d1b9f53e38c6440897e1d88537c266a30a8037908d3f4ee8c7ff563a70f232
Instruction Fuzzy Hash: E5717D75E2521A9FCB04DFA5D9444AEFBF2FF8A201F00E56AD016E7254E7789A01CF60

Function 072780A0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

5=6, xrefs: 072781CE

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: b61472bf3ced66e34fd429f51744cc34962f9f741531c3fccfc9927a5724da92
Instruction ID: 22d36987ca188400b64f3e4fc75fd1bfd0427af4f2c3129a57fda9b405014e46
Opcode Fuzzy Hash: b61472bf3ced66e34fd429f51744cc34962f9f741531c3fccfc9927a5724da92
Instruction Fuzzy Hash: A6617D75E2520A9FCB04DFA5D9444AEFBF2FF8A201F00E56AD016E7214E7789A01CF64

Function 07271E7A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769a5d77f134da9d15306f0ff79b629e6355a89ce17a852be1e40fcb233551fd
Instruction ID: f0866dea5f751c104004c1729578b6bb631ae68a8672e7e156d2bf9ea3b7dfe8
Opcode Fuzzy Hash: 769a5d77f134da9d15306f0ff79b629e6355a89ce17a852be1e40fcb233551fd
Instruction Fuzzy Hash: 633104B1E01618CBDB18CFABD9456DEBBF2BFC9310F14C06AE409A6268DB345946CF50

Function 04AAAE48 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04AAB09E

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4e05490157316932a2ea6b9a5060f99d42c9320ae6945f4168b9daee1b5dfb23
Instruction ID: 31070de4506843e40bc400a5c07c75bab1efbd713ec936530be46c5de940b0e1
Opcode Fuzzy Hash: 4e05490157316932a2ea6b9a5060f99d42c9320ae6945f4168b9daee1b5dfb23
Instruction Fuzzy Hash: 467123B0A00B059FDB24DF2AD44476ABBF1FF88304F00892AE49AD7A50E775F955CB91

Function 04AA590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04AA59C9

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e32933a0447bdcc0d2b03c0ba97b7c4d7cd5454835b1568d45b833ac9b7c78ff
Instruction ID: b2d54b5b603a49f504b4cb59ccfc2f875c849a01a7bb6631babdd9f156bd6a14
Opcode Fuzzy Hash: e32933a0447bdcc0d2b03c0ba97b7c4d7cd5454835b1568d45b833ac9b7c78ff
Instruction Fuzzy Hash: BC41DFB0D00619CFDB24DFAAC885BCDBBF5BF48314F20805AD408AB261DB75694ADF90

Function 04AA44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04AA59C9

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f4d4d091a0ec6cec691fd3f20936960282115dff2d72300feb6330ce5442736b
Instruction ID: 2467f4b7c513501ecf3147607e478291265d652e10e16b9ac331ce7600086267
Opcode Fuzzy Hash: f4d4d091a0ec6cec691fd3f20936960282115dff2d72300feb6330ce5442736b
Instruction Fuzzy Hash: C241DFB0D00719DBDB24CFAAC884B9EBBF5BF49314F20806AD408AB261DB756945DF90

Function 04AAB830 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04AAD6E6,?,?,?,?,?), ref: 04AAD7A7

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: df06ceb964a77f26ae1ffb09952c8283b54f4a2c626c236c6d0334dad4de097d
Instruction ID: c164bab56818c162f38afa94fd0c067a60715c2c6739d089bdbcfa1b67994cec
Opcode Fuzzy Hash: df06ceb964a77f26ae1ffb09952c8283b54f4a2c626c236c6d0334dad4de097d
Instruction Fuzzy Hash: 2221E6B5900248DFDB10CF9AD984AEEBFF9EB48320F14845AE954B7310D374A950CFA5

Function 04AAD719 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04AAD6E6,?,?,?,?,?), ref: 04AAD7A7

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 748c8e6c7c29480a6e724a957010565d2848c0e1bbc0f5e0b0b441801794f3d6
Instruction ID: a9df3f2343b34f1683a391b661a490257c6fad31d9d6f4f8c771f2e9050167e4
Opcode Fuzzy Hash: 748c8e6c7c29480a6e724a957010565d2848c0e1bbc0f5e0b0b441801794f3d6
Instruction Fuzzy Hash: AC21E4B5900258DFDB10CF9AD984ADEBBF9EB48320F14841AE958A7310D375A950CF65

Function 07277CB8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07277D33

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1527d08e7005d906fca5282cc2604ca08fdddbffb78802d5fcaf8c7d44007138
Instruction ID: d3ee20f736abc5c7bd2a4d96458e99e3b7f3b8d8df1ed4b804230f5a501a059c
Opcode Fuzzy Hash: 1527d08e7005d906fca5282cc2604ca08fdddbffb78802d5fcaf8c7d44007138
Instruction Fuzzy Hash: 9521F7B5900249DFCB10DF9AC984ADEFBF4FF48320F108429E958A7250D374A544CFA1

Function 07277CC0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07277D33

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5369e8d572c158c0d6dd36b0cc6cbf1ef862901a90b7d68d367b1cc0e08dee5c
Instruction ID: 66eb0d309f58cf44325196f784f110ad5bd887e907f1e0a225d8fbaf937ae5d7
Opcode Fuzzy Hash: 5369e8d572c158c0d6dd36b0cc6cbf1ef862901a90b7d68d367b1cc0e08dee5c
Instruction Fuzzy Hash: C321D3B5900249DFCB10DF9AC984ADEFBF8EB48320F148429E958A7250D778A944CFA5

Function 04AAB038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04AAB09E

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dcc2d48b7d38172f15f2ee423cc8761a21d27fc8bcad9c5a57392de2926a27c7
Instruction ID: eb44829f78e5bc8cd31fd34c0d8c5b2431b03cb70e50a25a8ae26d6d0cbbfc46
Opcode Fuzzy Hash: dcc2d48b7d38172f15f2ee423cc8761a21d27fc8bcad9c5a57392de2926a27c7
Instruction Fuzzy Hash: 7F110FB5C00249CFDB20CF9AC844A9EFBF8EF88320F14841AD928A7610D379A545CFA1

Function 009FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338792769.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a65e629760565746d0a39f571d504cf24661b55f2e01b2e6c2d7b4f0c27c32
Instruction ID: ff5200b0d546a96108ddc4ca24ade21b67a8a663817791efeae28aed8a2c97d0
Opcode Fuzzy Hash: 36a65e629760565746d0a39f571d504cf24661b55f2e01b2e6c2d7b4f0c27c32
Instruction Fuzzy Hash: 12212B71505208DFDB05DF14D9C0B36BF6AFB98314F24C569DA090B2A6C33AE856C7A1

Function 009FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338792769.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5168634812ff2ec9d236afc0af878d44186a505ca941969a93711a38c42cd06d
Instruction ID: e9aa38d8852aeb8ab5e6c289b3094d8de1fa5ac0932dd6b1044ac9e48007d4b8
Opcode Fuzzy Hash: 5168634812ff2ec9d236afc0af878d44186a505ca941969a93711a38c42cd06d
Instruction Fuzzy Hash: 8B2128B1505248DFDB05DF14D9C0B36BF66FB98318F24C569EA090B25AC33AD816D7A1

Function 023BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338952574.00000000023BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 023BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23bd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb688437142f90eacce25ca74e52d51bc25b10869727120ffe3d14ee0e77faa4
Instruction ID: 5574a21fa9e12d0a16c820a2aec20425b09b6df448df2b92cb6c83a28020a236
Opcode Fuzzy Hash: cb688437142f90eacce25ca74e52d51bc25b10869727120ffe3d14ee0e77faa4
Instruction Fuzzy Hash: 99210475604248DFDB16DF14D9C0B66BFA5FF88314F24C96DEA0A4BA46C33AD407CA61

Function 023BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338952574.00000000023BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 023BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23bd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340724442dbfbdf88e5c8b39d0927b2814ca2841dd669675a7d63df6532d7446
Instruction ID: 08737b0dfcb19136f3e333b1a6b11956338782af6f8630ade608223bad3f0991
Opcode Fuzzy Hash: 340724442dbfbdf88e5c8b39d0927b2814ca2841dd669675a7d63df6532d7446
Instruction Fuzzy Hash: 50212971914288DFDB06DF14D5C0B66BBA5FF88314F24C56DEA094FA52C336D406CB61

Function 023BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338952574.00000000023BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 023BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23bd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eccab98e301ff45fbba444434058f4ab3238946dff6595f033f7ad514e28545
Instruction ID: a3f687b6f640c74f7553d79bf3a4be4bb5df48bed2d3385f58be4cfb3ab85bb0
Opcode Fuzzy Hash: 5eccab98e301ff45fbba444434058f4ab3238946dff6595f033f7ad514e28545
Instruction Fuzzy Hash: 3E217F755083849FCB02CF14D994B11BF71EF46214F28C5DAD9498F6A6C33A985ACB62

Function 009FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338792769.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 5eafedbf44fe16361fd53bceb3f45c9d4c579a562b9eaea6ba1e0c588650428f
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 64112972404244CFDB11CF00D5C0B26BF72FB94324F24C2A9D9090B666C33AD456CBA1

Function 009FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338792769.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 95d565a51d50d0495ac02ed43c03cb2033a11312ee08192b333ac3f2077f21de
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 6A112972404284CFDF11CF10D5C0B26BF72FB94314F24C6A9E9090B25AC336D45ACB91

Function 023BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338952574.00000000023BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 023BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23bd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 350af30f7634819d5d2c00c3569a2f527063ca4b72d0609431a1ec451ed5f450
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: 5F11BB75904284DFDB12CF10C5C0B15BBB1FF84214F24C6A9D9494F696C33AD40ACB61

Function 009FD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338792769.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba926eeec9b0a7375c0e51b26588c10f0c02cb4995d049d52ec0b0ffa38e680
Instruction ID: 33bc84f7a5f20639caed39cd15239f9b852980cb3efbfe2435420d7f1cb09795
Opcode Fuzzy Hash: 1ba926eeec9b0a7375c0e51b26588c10f0c02cb4995d049d52ec0b0ffa38e680
Instruction Fuzzy Hash: 4F012BB10063489AE720AE16CC84B76BFADDF41334F18C95AEE094F286D2399C40CBB1

Function 009FD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338792769.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f6c23c00bbfea7a2e751df3219368f5d072ee828d319e681acc29f3fc7b3e6
Instruction ID: 83c039b5ab2951095c31672f4c0c2aa8d3d6a5487ee70dd22c5ab8d7fccdb8f9
Opcode Fuzzy Hash: 21f6c23c00bbfea7a2e751df3219368f5d072ee828d319e681acc29f3fc7b3e6
Instruction Fuzzy Hash: 0AF06272405344AAF711AE16C884B62FF9CEB51734F18C55AEE084F296C2799844CBB1

Non-executed Functions

Function 0727A570 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

{#L, xrefs: 0727A748

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 865b6d87e119ddc722589fdbc519d3ab3ed0dbcc7636ef4cfa565e6e022032a5
Instruction ID: db95712459e7f716fd6b0a8d2bf20fbd27dfacc78b7e4d93d0b944722b2cd0b5
Opcode Fuzzy Hash: 865b6d87e119ddc722589fdbc519d3ab3ed0dbcc7636ef4cfa565e6e022032a5
Instruction Fuzzy Hash: 3AD116B1E25219DBCB18CFAACA8059EFBF2FF89310F54D52AD415AB224D7349942CF50

Function 0727A560 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

{#L, xrefs: 0727A748

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 36cb2e1b811e6667c637a83536db53f0aff9f82fa4814191baab769d7b382ae6
Instruction ID: 995d32e15282f97383888c09022f144be0b4ac8f9a3385d2b434605a302a8934
Opcode Fuzzy Hash: 36cb2e1b811e6667c637a83536db53f0aff9f82fa4814191baab769d7b382ae6
Instruction Fuzzy Hash: 0BD117B1E25219DBCB18CFAACA8059EFBF2FF89310F54D52AD415AB224D7349942CF50

Function 072718D9 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

98R, xrefs: 07271A43

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: 98R
API String ID: 0-576591972
Opcode ID: 1222f1754bd0dcd3614320b9b3d31b958aab3eb12b92fe4fafdd2d56c205ec14
Instruction ID: c994c81e5f5dc8dba52a5b148ecda4f48dbd7e97ecfed2a75d826bebfe013fe8
Opcode Fuzzy Hash: 1222f1754bd0dcd3614320b9b3d31b958aab3eb12b92fe4fafdd2d56c205ec14
Instruction Fuzzy Hash: EC7114B5E2520ADFCB04CF99D5819AEFBB2EF8A310F148429D415AB214D374AA52CF94

Function 07278698 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

iUfo, xrefs: 072787AE

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: 490a5519999c8354e7b30151a7668c54100222f9c752c2c22ab2092aeb6c94fd
Instruction ID: 67573fbd790b0af262d92e83e34e3e864ff23424e7583f4fd9866b8d2f38a6ad
Opcode Fuzzy Hash: 490a5519999c8354e7b30151a7668c54100222f9c752c2c22ab2092aeb6c94fd
Instruction Fuzzy Hash: 4951C2B8E152199FCB08CFA9D9495EEFBF2FF89300F10942AD406BB254E7785941CB64

Function 07278688 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

iUfo, xrefs: 072787AE

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: 76034e212aefef1f1a23c3a4b57633245a23c504f4725c7ba29634e9c99a69d9
Instruction ID: ab70d05e9c0651772341dbdbfa62f7973b3fe7dcc63f9922f2e9c2575824a354
Opcode Fuzzy Hash: 76034e212aefef1f1a23c3a4b57633245a23c504f4725c7ba29634e9c99a69d9
Instruction Fuzzy Hash: 4D5104B8E112199FCB04CFA9D6496EEBBF2FF89300F10902AD405BB254E7785941CB64

Function 07271440 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

-2m, xrefs: 07271563

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: 412a14308c5ceff64d20e7de593032db65f22c1eb13db0d0786912a2f9c6b513
Instruction ID: 7c37a95e1dd1a40b374ce13d15306f6b746ccb83c9b76c2a7ef075ad040e46ee
Opcode Fuzzy Hash: 412a14308c5ceff64d20e7de593032db65f22c1eb13db0d0786912a2f9c6b513
Instruction Fuzzy Hash: 2F5118B4E252198FCB08CFAAD5406AEFBF2FFC9301F24D06AD419A7254E7349941CB64

Function 07278A90 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

w7e^, xrefs: 07278BC5

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 5cb5ab0bb4b415c545742ff36950f6912c701ae81acae10345e1fb4f33c8031d
Instruction ID: 6a919071bb60e9140eb9bb4e260c52a2599c8d61b751a392d6dda6ce03d2d121
Opcode Fuzzy Hash: 5cb5ab0bb4b415c545742ff36950f6912c701ae81acae10345e1fb4f33c8031d
Instruction Fuzzy Hash: 054145B5D25219DFCF04CFAACA455EEFBB1FB8A200F14982AC416B7244D3784642CF68

Function 07278A80 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

w7e^, xrefs: 07278BC5

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 3d19ee0e6d3b30fe6c306cc86e999877e42252d4a8fa5739f7626988604c8ee2
Instruction ID: 2ed7c3ba07a1c80aaeb03961d30005c8e86aa01e77a90ca7f379e09b22c73c01
Opcode Fuzzy Hash: 3d19ee0e6d3b30fe6c306cc86e999877e42252d4a8fa5739f7626988604c8ee2
Instruction Fuzzy Hash: C94138B5D2521ADFCF04CFA6C6456EEFBB1BB8A200F14982AC416B7254D7784642CF58

Function 07275588 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0ni, xrefs: 072756F3

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: f06a0220fa36b914afe3ab6cd348b507698879709b57d79e8021078a684f4e4d
Instruction ID: 0b877ef0c03d2eef6eb1b49f721575a9419aa87f0073ce9d6b84617d7fe26f35
Opcode Fuzzy Hash: f06a0220fa36b914afe3ab6cd348b507698879709b57d79e8021078a684f4e4d
Instruction Fuzzy Hash: 285159B1E116198BDB68DF6BCD4579AFAF3BFC8300F14C1BA950CA6214EB340A858F51

Function 0727557A Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

0ni, xrefs: 072756F3

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: f8b15e50e876c978b072b9fb4bc009f500cd094241c79d007c84c629750b3368
Instruction ID: 69963626eff0be5c8a56dc5dc2307f94ce11de88cfb0a11a90e8b467f9e63df6
Opcode Fuzzy Hash: f8b15e50e876c978b072b9fb4bc009f500cd094241c79d007c84c629750b3368
Instruction Fuzzy Hash: F5514AB1E016198BDB68CF6B8D4579AFBF3BFC9300F14C1BA950CA6214EB340A858F51

Function 04AAD404 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350267957.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72db15faa29057f93acc3efc6a60cace578f861919aa447a965e81cfd1dd94a4
Instruction ID: f1e1ffd0cf60724fb4e712a2b1f8a230d8cb7e2e8681f2f832ab324eb80cc9e5
Opcode Fuzzy Hash: 72db15faa29057f93acc3efc6a60cace578f861919aa447a965e81cfd1dd94a4
Instruction Fuzzy Hash: A3A18D32E002098FCF19DFB4C94459EB7B2FF89304B15816AF905AB261DB35E966CB80

Function 07279FC8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b4f25fc7d51f80866e1e59f6ddd2d4907c5788c295c5409bc346b13b3e2821
Instruction ID: 83dfd0b6879449af8bff79b1b3df3e0d96d2855a1419680febcc18ce347dc5b6
Opcode Fuzzy Hash: d9b4f25fc7d51f80866e1e59f6ddd2d4907c5788c295c5409bc346b13b3e2821
Instruction Fuzzy Hash: 03B1FCB1D25219DFDB18CFAAD64069EFBB2FF89310F20D42AD019A7254D7746A46CF10

Function 07279FBA Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76dd18a63d92f0cc4af9f8b90f872f7565e8319a6d0c4bf27049c520781160c
Instruction ID: 6a8eb6b159ed85628e4503d120c2063d478e48277bd604dd32f87960e730d720
Opcode Fuzzy Hash: c76dd18a63d92f0cc4af9f8b90f872f7565e8319a6d0c4bf27049c520781160c
Instruction Fuzzy Hash: 11B1FBB1D25219DFDB18CFAAD68069EFBB2FF89310F20D42AD419A7254D7746A42CF10

Function 07273D08 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00684507e2ac94555a4661beaa6cce43e29f714daea9eaf55465cc63b8c80d83
Instruction ID: 2d02987653fdcfdadcfa8382a7fc4a96116d9d7f6ac6b09dd082b2ebaf5e5068
Opcode Fuzzy Hash: 00684507e2ac94555a4661beaa6cce43e29f714daea9eaf55465cc63b8c80d83
Instruction Fuzzy Hash: 6491E3B5A2525ACFCB04CF99C68489EFBF1FF89310F249559D415AB321D370AA41CF51

Function 07273CF8 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710b84c5e429898e83ca7d90335ff490231c06206e5ed44d82552581e6e16401
Instruction ID: d681eac2ea6814b1d2d98ea31a59b2c5fa59bf1cb889e360e85c445a538b4b7e
Opcode Fuzzy Hash: 710b84c5e429898e83ca7d90335ff490231c06206e5ed44d82552581e6e16401
Instruction Fuzzy Hash: C28115B5A2525ACFCB04CF99C68499EFBF1FF89310F248566D415AB321D330AA41CF51

Function 07278E40 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d625028dc2deebd9e63969ee0aa625d1d0f6aa096a748005a12c60c4e7dce1
Instruction ID: 154904a6252c466ec29e18b627d88eeac92134c29ba320069d9dd007df694f65
Opcode Fuzzy Hash: 02d625028dc2deebd9e63969ee0aa625d1d0f6aa096a748005a12c60c4e7dce1
Instruction Fuzzy Hash: 90812DB4E142598FCB14DFA9C5809AEFBB6BF89300F24C169D458A7315D730AA82CF61

Function 07275118 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84dd0a18be6d389308d786f01d2f86804e61d5e548cad5c2c1c317e8e793383a
Instruction ID: 2c20cd2aa3ee2e33814406e7b936d3b5c69ea4e506f2e5734af369870a552b97
Opcode Fuzzy Hash: 84dd0a18be6d389308d786f01d2f86804e61d5e548cad5c2c1c317e8e793383a
Instruction Fuzzy Hash: 2771FBB4E2560ACFCB04CFAAC6805DDFBF2FF89211F24A429D415B7224D3749951CB54

Function 07275108 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647cbf90a2bbb82455933510e57ef37ba8595f7a5d270e43b2650940a01913d2
Instruction ID: 39bbc142a5ba846ee91af9f86065bad8c7900e2027269f0a4999f73248f5b343
Opcode Fuzzy Hash: 647cbf90a2bbb82455933510e57ef37ba8595f7a5d270e43b2650940a01913d2
Instruction Fuzzy Hash: 78711CB4E25609CFCB04CFAAC6805DEFBF2FF89210F24A42AD415B7224D3749951CB64

Function 07278348 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68e454f7821b03866a28c323327808b512484986b821ef3b90a546a23e0d112
Instruction ID: be3998b47ed4753eafb447f514160786586a4cf300e3d21c893c84a541d539aa
Opcode Fuzzy Hash: e68e454f7821b03866a28c323327808b512484986b821ef3b90a546a23e0d112
Instruction Fuzzy Hash: D1416DB0E2520ADFCB04CFAAD6456AEFBF1EF89300F20D46AC514B7254E3748641CB94

Function 072753A8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf60276dc20862f44249dec9889e506abe93d1ce921eb0775b700fe484d7190
Instruction ID: 0c131695b35bc1f8b321cafc77dea2e1e70009a3670a0a211c6119ff5ddf68e9
Opcode Fuzzy Hash: faf60276dc20862f44249dec9889e506abe93d1ce921eb0775b700fe484d7190
Instruction Fuzzy Hash: 884109B0E2521ADBCB44CFAAC5815AEFBF2FF89300F20C569C405B7254D7749A51CBA4

Function 07275398 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c149665d8d73ef09ade1f669f060d265986a8bbe781b8e7c0841da241813830
Instruction ID: 5c4161dec176fca41e3517bd7a2229045d71fc6096c0ec6615a394a5650e39cb
Opcode Fuzzy Hash: 7c149665d8d73ef09ade1f669f060d265986a8bbe781b8e7c0841da241813830
Instruction Fuzzy Hash: 56411BB0E1520ADBCB04CFAAC5815AEFBF2EF89300F24D569C405B7264D7749A51CB94

Function 07274F00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c122e15f19bae10746c8cd399129cbf5dbd1ce8adf34013aa9a35001056345e
Instruction ID: 339b1a27c8b37257c546c7f1fa29967f52e8cd817997a461b8864d77375fbcaa
Opcode Fuzzy Hash: 5c122e15f19bae10746c8cd399129cbf5dbd1ce8adf34013aa9a35001056345e
Instruction Fuzzy Hash: 184109B0E2424ADBCB04DFAAD5815AEFBF2FF89300F14C46AD415A7254D3349A41CF95

Function 07278358 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c37ef3f427f73535266be0360217376d2bcacb6851f9ce534b35172698c5a74
Instruction ID: 7c0a5d999fc18e0ef22a3771e176c83e94d0b7c83f237ff2883983d4d743e0e6
Opcode Fuzzy Hash: 4c37ef3f427f73535266be0360217376d2bcacb6851f9ce534b35172698c5a74
Instruction Fuzzy Hash: 9A414BB0E2520ADFCB04CFAAD6456AEFBF1EB89304F20946AC514B7264E3749701CB94

Function 07274F10 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43fa78dad9df55a77f14367870e7637c0a0b9668eb06c6ca5e961c449467e69
Instruction ID: 859db372c13c0ffb051659dedcff8c33a6b2b4585034f331d34a2a26df4588b6
Opcode Fuzzy Hash: b43fa78dad9df55a77f14367870e7637c0a0b9668eb06c6ca5e961c449467e69
Instruction Fuzzy Hash: 2041E4B0E2520ADBCB04DFAAC5815AEFBF2EF89300F14C46AD415A7204D3349A41CF95

Function 0727001F Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c0d630bfd5952b130273a9031881cc9f50f601766ff3043f2c11cfb86708c4
Instruction ID: dfe6f816f69bacd918f0a580b7985794cb408708e7f5d8ebbcf35297b5649d9d
Opcode Fuzzy Hash: 75c0d630bfd5952b130273a9031881cc9f50f601766ff3043f2c11cfb86708c4
Instruction Fuzzy Hash: EB21FC71E056589FEB59CFAB98106DEFBF3AFC9200F18C0BAD448A6265DB340546CF61

Function 07270040 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352535904.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53f50a4abf287a3be7c822d78c70e9c78dc6909714da4d51a2054c96180afe9
Instruction ID: d2e3df467940dcc2f86f7f3832db7f0ed91bf5cbd7209611dd6ac4fa1738c55e
Opcode Fuzzy Hash: b53f50a4abf287a3be7c822d78c70e9c78dc6909714da4d51a2054c96180afe9
Instruction Fuzzy Hash: 9E11DAB1E106189BEB18CFABD90069EFAF7AFC9210F04C07AC918B6214EB740656CF51

Analysis Process: VmoLw6EKj5.exePID: 7548, Parent PID: 7388COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	7

Executed Functions

Function 010AAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010AB086

Memory Dump Source

Source File: 00000003.00000002.2579954004.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a0000_VmoLw6EKj5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4605e0b23e6224e3d5bfaae32b36b0d388b7bf68fb5dcd6078c4c47bc31fa9dd
Instruction ID: a3e6a983fe157e5a25b66955bc092b658a21527c871f1ff820bd902f6616ebd9
Opcode Fuzzy Hash: 4605e0b23e6224e3d5bfaae32b36b0d388b7bf68fb5dcd6078c4c47bc31fa9dd
Instruction Fuzzy Hash: E87135B0A00B45CFD764DFA9D44479ABBF5FF88300F408A29E58A9BA90D775E845CB90

Function 05340BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05344381

Memory Dump Source

Source File: 00000003.00000002.2582414102.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5340000_VmoLw6EKj5.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 343a8d3b6b2d0d6c79ef8c00747611e1786d19be220827d18eabc99dc10bd7aa
Instruction ID: 32a0d36901283fd3e1419836ec41eb669f68fa146016332f6285f1d9cb2285ce
Opcode Fuzzy Hash: 343a8d3b6b2d0d6c79ef8c00747611e1786d19be220827d18eabc99dc10bd7aa
Instruction Fuzzy Hash: 234117B5A00249CFCB14CF99C488BAABBF5FF88714F24C559E519AB321D775A841CFA0

Function 010A4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010A59F1

Memory Dump Source

Source File: 00000003.00000002.2579954004.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a0000_VmoLw6EKj5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c54d427204a73881566f1adfa436d943c1bb8995e9a6a2ac183f70c76b5aaae3
Instruction ID: b7b8a74ea99299620a85f59a68213bf7cc0663fb65ea72a2b6fee2012fb62df7
Opcode Fuzzy Hash: c54d427204a73881566f1adfa436d943c1bb8995e9a6a2ac183f70c76b5aaae3
Instruction Fuzzy Hash: 9C41DFB0D00719CADB24CFAAC884B8DBBF5FF49304F6081AAD448AB251DB756946CF90

Function 010A5935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010A59F1

Memory Dump Source

Source File: 00000003.00000002.2579954004.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a0000_VmoLw6EKj5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d320a07cb47520ffa8cc32f929702d7b17d8f0e79673a6d63ebf7167fae58c90
Instruction ID: d94d0f7942d9e02a6d2c10d4df613879741102a83fd9c89d678787c06aed195e
Opcode Fuzzy Hash: d320a07cb47520ffa8cc32f929702d7b17d8f0e79673a6d63ebf7167fae58c90
Instruction Fuzzy Hash: 4941EFB0D00719CEDB24CFA9C888B8DBBF5FF48304F24816AD448AB251DB756946CF90

Function 010AC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010AD2C6,?,?,?,?,?), ref: 010AD387

Memory Dump Source

Source File: 00000003.00000002.2579954004.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a0000_VmoLw6EKj5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e48e9da31d88e8c8154a7962195667215a41521c1c7e54aab441ec020d83fd5f
Instruction ID: 2e8d092af416a011cbeba82eb45aba4e38d21b1f9cc39d3247983a2f6a54094e
Opcode Fuzzy Hash: e48e9da31d88e8c8154a7962195667215a41521c1c7e54aab441ec020d83fd5f
Instruction Fuzzy Hash: D421E5B5900248DFDB10CF9AD984ADEBFF8EB48320F14845AE954A7310D374A950CFA5

Function 010AD2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010AD2C6,?,?,?,?,?), ref: 010AD387

Memory Dump Source

Source File: 00000003.00000002.2579954004.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a0000_VmoLw6EKj5.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 37ffe4966e7395c6e037bd4abad10d4351a3a230ee5cd2ef24dfbf7ce99c8518
Instruction ID: 496d3e1ce860167bc94f78a324ebf44b56590287bee3624a89e81ead50c375c3
Opcode Fuzzy Hash: 37ffe4966e7395c6e037bd4abad10d4351a3a230ee5cd2ef24dfbf7ce99c8518
Instruction Fuzzy Hash: 0F21E3B5D00248DFDB10CFA9D584ADEBBF4EB48320F14841AE958A3210D374A940CF61

Function 010AB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010AB086

Memory Dump Source

Source File: 00000003.00000002.2579954004.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a0000_VmoLw6EKj5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d5119b28889e5ce1011186b32eb6f48dfeb0c01e39c4e69211d599d500744dd3
Instruction ID: 70e2fc53a46c5829fb62a5dd1d474d1b8e1787fa48d8f642580c60c65499adcb
Opcode Fuzzy Hash: d5119b28889e5ce1011186b32eb6f48dfeb0c01e39c4e69211d599d500744dd3
Instruction Fuzzy Hash: 2811DFB5C007498FDB20CF9AC444A9EFBF8EB88220F14845AD569A7210C379A545CFA1

Function 0103D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2579515591.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_103d000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188c6ad3c0b82a5857c36b5fd2ec3be832f9d7ec0695fa8ef0295fd13f3f1795
Instruction ID: 111ee0aa114908f7100a77f0b08e36d4a3d38b7723cfa28a2e42a25340c4fbc2
Opcode Fuzzy Hash: 188c6ad3c0b82a5857c36b5fd2ec3be832f9d7ec0695fa8ef0295fd13f3f1795
Instruction Fuzzy Hash: 332133B1504200DFDB01DF98D9C0B6ABFA9FBC8324F24C5A9E9490B246C736E416CBA1

Function 0105D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2579725945.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_105d000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a861f8179f68198074e39ac79a5bdbacace84a0174b14d4a561257ad800fe3dd
Instruction ID: 076ae96edca2d3820d4a018bad32e406cb644b0aac3e4fd7929514b59e1b6a11
Opcode Fuzzy Hash: a861f8179f68198074e39ac79a5bdbacace84a0174b14d4a561257ad800fe3dd
Instruction Fuzzy Hash: 1F210371504200DFDB95DF58D480B17BBA5EB88314F24C9AEED894B246C33AD407CB61

Function 0105D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2579725945.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_105d000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc0050d94dc1ab45321b63b703cd1486e2e002a58125662e74e80f8d83dbf6a
Instruction ID: 8713b5013b3598c058b094cfb0d8e98e304e30fcdb5d2c82249072b8693c084d
Opcode Fuzzy Hash: 5bc0050d94dc1ab45321b63b703cd1486e2e002a58125662e74e80f8d83dbf6a
Instruction Fuzzy Hash: 1B2192755093808FDB53CF64D990715BFB1EB45214F28C5DBD8898B2A7C33A940ACB62

Function 0103D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2579515591.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_103d000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: d137920be46c8420546bba3c2a4ce20c23009fea83f197f6ec7ef157c9c0c954
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 78110072404280CFDB12CF54D9C0B56BFB2FB84324F24C2A9D9490B257C33AE45ACBA2

Function 0103D5F3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2579515591.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_103d000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bfa330521790b5162b974caef2add9680127b5e0f9f768327e12edd04f9494
Instruction ID: b4a8f089dd516ce9ab9e291505526b56328debcc8d410adce2c469f8f4c288dd
Opcode Fuzzy Hash: e5bfa330521790b5162b974caef2add9680127b5e0f9f768327e12edd04f9494
Instruction Fuzzy Hash: 5BF0FFB5600600AF97108F4AD985C27FBEDFBD4670755C55AE85A4B712C671EC41CBA0

Function 0103D5E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2579515591.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_103d000_VmoLw6EKj5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887d1fc8c5d24784dddde033afd5a9cdcdbec2f099a9545c02103e0ea8aa86e5
Instruction ID: c7e5e00cd76bdcbfde0b0e5372a1ec1991a77d48418a85591411706cb380760a
Opcode Fuzzy Hash: 887d1fc8c5d24784dddde033afd5a9cdcdbec2f099a9545c02103e0ea8aa86e5
Instruction Fuzzy Hash: 12F03C75104680AFD7158F56C984C22BFF9FFC96607198489E89A4B362C631FC42CB60

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VmoLw6EKj5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VmoLw6EKj5.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
VmoLw6EKj5.exe

Function 07272C96 Relevance: 4.1, Strings: 3, Instructions: 320
COMMON

Function 07272CAD Relevance: 4.1, Strings: 3, Instructions: 317
COMMON

Function 07272CF8 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Function 07270B3D Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Function 07270B76 Relevance: 4.0, Strings: 3, Instructions: 228
COMMON

Function 07270B90 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Function 072796C8 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Function 072796B8 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Function 04AAAE48 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 04AA590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 04AA44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04AAB830 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 04AAD719 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON