Edit tour

Windows Analysis Report
5tCuNr661k.exe

Overview

General Information

Sample name:	5tCuNr661k.exe renamed because original name is a hash value
Original sample name:	309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8.exe
Analysis ID:	1588744
MD5:	12dea314db7aa2b97f2c43a4081d4f66
SHA1:	67c73c5207f877ca7a075f38ff32acb4129ecf17
SHA256:	309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8
Tags:	exeRedLineStealeruser-adrian__luca
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

5tCuNr661k.exe (PID: 2700 cmdline: "C:\Users\user\Desktop\5tCuNr661k.exe" MD5: 12DEA314DB7AA2B97F2C43A4081D4F66)

5tCuNr661k.exe (PID: 1048 cmdline: "C:\Users\user\Desktop\5tCuNr661k.exe" MD5: 12DEA314DB7AA2B97F2C43A4081D4F66)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2609693262.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 5tCuNr661k.exe PID: 2700	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 5tCuNr661k.exe PID: 2700	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 5tCuNr661k.exe PID: 1048	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.5tCuNr661k.exe.4bbb800.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.5tCuNr661k.exe.4bbb800.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296be:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.5tCuNr661k.exe.4b705e0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.5tCuNr661k.exe.4b705e0.1.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296be:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.5tCuNr661k.exe.4b705e0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.5tCuNr661k.exe.4b705e0.1.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x4a838:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x278be:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.5tCuNr661k.exe.4bbb800.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.5tCuNr661k.exe.4bbb800.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x4a638:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x278be:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
3.2.5tCuNr661k.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.5tCuNr661k.exe.400000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296be:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.5tCuNr661k.exe.4ae0fc0.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.5tCuNr661k.exe.4ae0fc0.3.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xb42e3:$gen01: ChromeGetRoamingName 0xb4308:$gen02: ChromeGetLocalName 0xb434b:$gen03: get_UserDomainName 0xb81e4:$gen04: get_encrypted_key 0xb6f63:$gen05: browserPaths 0xb7239:$gen06: GetBrowsers 0xb6b21:$gen07: get_InstalledInputLanguages 0xb2fec:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x92638:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0xb8626:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0xb86c4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0xb8cde:$spe9: wallet 0xb100a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xb1534:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xb15e1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xb0fb8:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xb0fe1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xb11b2:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xb1405:$typ11: 2A19BFD7333718195216588A698752C517111B02 0xb16f4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.5tCuNr661k.exe.4a519a0.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.5tCuNr661k.exe.4a519a0.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x143903:$gen01: ChromeGetRoamingName 0x143928:$gen02: ChromeGetLocalName 0x14396b:$gen03: get_UserDomainName 0x147804:$gen04: get_encrypted_key 0x146583:$gen05: browserPaths 0x146859:$gen06: GetBrowsers 0x146141:$gen07: get_InstalledInputLanguages 0x14260c:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x121c58:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x147c46:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x147ce4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x1482fe:$spe9: wallet 0x14062a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x140b54:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x140c01:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1405d8:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x140601:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1407d2:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x140a25:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x140d14:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Click to see the 9 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: 5tCuNr661k.exe	Virustotal: Detection: 71%			Perma Link
Source: 5tCuNr661k.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 5tCuNr661k.exe

Joe Sandbox ML: detected

Source: 5tCuNr661k.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5tCuNr661k.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb5 source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000E93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb< source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.ServiceModel.pdb$! source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000E93000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.120.86:1912

Source: global traffic

TCP traffic: 192.168.2.9:49756 -> 87.120.120.86:1912

Source: Joe Sandbox View

IP Address: 87.120.120.86 87.120.120.86

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86

Source: 5tCuNr661k.exe, 00000000.00000002.1376910425.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://localhost/arkanoid_server/requests.php
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LR
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/x
Source: 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2609693262.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.5tCuNr661k.exe.4bbb800.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.5tCuNr661k.exe.4b705e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.5tCuNr661k.exe.4b705e0.1.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.5tCuNr661k.exe.4bbb800.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 3.2.5tCuNr661k.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.5tCuNr661k.exe.4ae0fc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.5tCuNr661k.exe.4a519a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C22C8	0_2_014C22C8
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C7408	0_2_014C7408
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014CA54B	0_2_014CA54B
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C094A	0_2_014C094A
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C097E	0_2_014C097E
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C09DF	0_2_014C09DF
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C09AB	0_2_014C09AB
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C08CE	0_2_014C08CE
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C08FF	0_2_014C08FF
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0B1B	0_2_014C0B1B
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0BD3	0_2_014C0BD3
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0B9F	0_2_014C0B9F
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C2BA8	0_2_014C2BA8
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C2BB8	0_2_014C2BB8
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0A0C	0_2_014C0A0C
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0A85	0_2_014C0A85
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0D67	0_2_014C0D67
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0CCD	0_2_014C0CCD
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0C99	0_2_014C0C99
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0E04	0_2_014C0E04
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C0EAB	0_2_014C0EAB
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C3167	0_2_014C3167
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C309D	0_2_014C309D
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C35F0	0_2_014C35F0
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C3719	0_2_014C3719
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C3600	0_2_014C3600
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1B4B	0_2_014C1B4B
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1BA3	0_2_014C1BA3
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1A45	0_2_014C1A45
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1A71	0_2_014C1A71
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1C45	0_2_014C1C45
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1FE9	0_2_014C1FE9
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1FFE	0_2_014C1FFE
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1E0A	0_2_014C1E0A
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_014C1EFA	0_2_014C1EFA
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053C9AA0	0_2_053C9AA0
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053CE930	0_2_053CE930
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053CE921	0_2_053CE921
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053C12C4	0_2_053C12C4
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053C38E0	0_2_053C38E0
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053C38D0	0_2_053C38D0
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_053C9A90	0_2_053C9A90
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097FC838	0_2_097FC838
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097FE4B8	0_2_097FE4B8
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097FAEC0	0_2_097FAEC0
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_00DB25D8	3_2_00DB25D8
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_00DBDC74	3_2_00DBDC74
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_04F6EE58	3_2_04F6EE58
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_04F68850	3_2_04F68850
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_04F60040	3_2_04F60040
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_04F60007	3_2_04F60007
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_04F68840	3_2_04F68840

Source: 5tCuNr661k.exe, 00000000.00000002.1375714013.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1380024284.00000000047C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1390445470.0000000007DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1391179683.0000000009B00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000000.1364540386.0000000000AE8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekKCN.exe0 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1376910425.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe, 00000003.00000002.2609693262.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 5tCuNr661k.exe
Source: 5tCuNr661k.exe	Binary or memory string: OriginalFilenamekKCN.exe0 vs 5tCuNr661k.exe

Source: 5tCuNr661k.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.5tCuNr661k.exe.4bbb800.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.5tCuNr661k.exe.4b705e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.5tCuNr661k.exe.4b705e0.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.5tCuNr661k.exe.4bbb800.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 3.2.5tCuNr661k.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.5tCuNr661k.exe.4ae0fc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.5tCuNr661k.exe.4a519a0.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: 5tCuNr661k.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\5tCuNr661k.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5tCuNr661k.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Mutant created: NULL

Source: 5tCuNr661k.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5tCuNr661k.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5tCuNr661k.exe	Virustotal: Detection: 71%
Source: 5tCuNr661k.exe	ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\5tCuNr661k.exe "C:\Users\user\Desktop\5tCuNr661k.exe"
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process created: C:\Users\user\Desktop\5tCuNr661k.exe "C:\Users\user\Desktop\5tCuNr661k.exe"
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process created: C:\Users\user\Desktop\5tCuNr661k.exe "C:\Users\user\Desktop\5tCuNr661k.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 5tCuNr661k.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5tCuNr661k.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb5 source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000E93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb< source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.ServiceModel.pdb$! source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000E93000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097F89E3 push edx; iretd	0_2_097F89E4
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097F8AD2 push 0000003Dh; iretd	0_2_097F8AD4
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097FB1E8 push ss; iretd	0_2_097FB1EA
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097FB1D1 push ss; iretd	0_2_097FB1D2
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097F402C push esp; retf	0_2_097F402D
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097FB205 push ss; iretd	0_2_097FB207
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 0_2_097F85AB push esi; iretd	0_2_097F85AC
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Code function: 3_2_04F6D442 push eax; ret	3_2_04F6D451

Source: 5tCuNr661k.exe

Static PE information: section name: .text entropy: 7.784152143328839

Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 5tCuNr661k.exe PID: 2700, type: MEMORYSTR

Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 5500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 6500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 6630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 7630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: B660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: C660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe TID: 2136

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 5tCuNr661k.exe, 00000003.00000002.2610674164.0000000000E93000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Memory written: C:\Users\user\Desktop\5tCuNr661k.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Process created: C:\Users\user\Desktop\5tCuNr661k.exe "C:\Users\user\Desktop\5tCuNr661k.exe"

Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Users\user\Desktop\5tCuNr661k.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Users\user\Desktop\5tCuNr661k.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5tCuNr661k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\5tCuNr661k.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.5tCuNr661k.exe.4bbb800.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4b705e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4b705e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4bbb800.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.5tCuNr661k.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4ae0fc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4a519a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2609693262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5tCuNr661k.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5tCuNr661k.exe PID: 1048, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.5tCuNr661k.exe.4bbb800.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4b705e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4b705e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4bbb800.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.5tCuNr661k.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4ae0fc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5tCuNr661k.exe.4a519a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2609693262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5tCuNr661k.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5tCuNr661k.exe PID: 1048, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5tCuNr661k.exe	71%	Virustotal		Browse
5tCuNr661k.exe	61%	ReversingLabs	Win32.Trojan.Jalapeno
5tCuNr661k.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
87.120.120.86:1912	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/Entity/Id10Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2609693262.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/x	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2LR	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rmX	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://localhost/arkanoid_server/requests.php	5tCuNr661k.exe, 00000000.00000002.1376910425.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/actor/next	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14Response	5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, 5tCuNr661k.exe, 00000003.00000002.2611336535.0000000002B93000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.120.86	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588744
Start date and time:	2025-01-11 04:56:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5tCuNr661k.exe renamed because original name is a hash value
Original Sample Name:	309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 74 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 2.23.242.162, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:57:06	API Interceptor	1x Sleep call for process: 5tCuNr661k.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
87.120.120.86	shaLnqmyTS.exe	Get hash	malicious	RedLine	Browse
	shaLnqmyTS.exe	Get hash	malicious	RedLine	Browse
	zAGUEDGSTM.exe	Get hash	malicious	RedLine	Browse
	C5Zr4LSzmp.exe	Get hash	malicious	RedLine	Browse
	C5Zr4LSzmp.exe	Get hash	malicious	RedLine	Browse
	VmoLw6EKj5.exe	Get hash	malicious	RedLine	Browse
	Xf3rn1smZw.exe	Get hash	malicious	RedLine	Browse
	2eRd5imEKU.exe	Get hash	malicious	RedLine	Browse
	2eRd5imEKU.exe	Get hash	malicious	RedLine	Browse
	17.12.2024 ________.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	shaLnqmyTS.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	shaLnqmyTS.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	zAGUEDGSTM.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	WtZl31OLfA.exe	Get hash	malicious	Remcos, GuLoader	Browse	87.120.116.187
	C5Zr4LSzmp.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	C5Zr4LSzmp.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	2XnMqJW0u1.exe	Get hash	malicious	XWorm	Browse	87.120.120.15
	VmoLw6EKj5.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	QwMcsmYcxv.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	87.120.120.15
	QwMcsmYcxv.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	87.120.120.15

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5tCuNr661k.exe.log

Download File

Process:	C:\Users\user\Desktop\5tCuNr661k.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.630688730462622
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	5tCuNr661k.exe
File size:	877'568 bytes
MD5:	12dea314db7aa2b97f2c43a4081d4f66
SHA1:	67c73c5207f877ca7a075f38ff32acb4129ecf17
SHA256:	309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8
SHA512:	9c9dd9b9011739ce1159e302690dc522110d5fe33b671074aa1193b9cc7576abc9d4017ff49adf2c473d8e52582395f0b3a9f2db65e026e0e021c8067facabdc
SSDEEP:	24576:3fIeejFpYqPMy5lp8/EZWmBCfpAJ7WXYsstJ:PBejFp/0iwReChA1WXCf
TLSH:	BC15F198B600F48FC843C6318E69EC7466506DEED207930B65D73EAFF96EA538D16093
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ng..............0..P...........o... ........@.. ....................................@................................

File Icon


Icon Hash:	4b66a4ecc5ce527b

Static PE Info

General

Entrypoint:	0x4c6f2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674EADCB [Tue Dec 3 07:05:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc6ed4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x10e18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc4f34	0xc5000	f11c7a9b86e5243671e47fb6141ada0f	False	0.9096890367227157	data	7.784152143328839	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc8000	0x10e18	0x11000	322916f6508e625b6efcc1faccf298ba	False	0.2195111443014706	data	4.328310135772269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	52821257853a5c24cd2290f100afe99a	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc8160	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	0.21470188098899798
RT_GROUP_ICON	0xd8988	0x14	data	1.0
RT_GROUP_ICON	0xd899c	0x14	data	1.05
RT_VERSION	0xd89b0	0x278	data	0.4699367088607595
RT_MANIFEST	0xd8c28	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:57:09.552530050 CET	49756	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:09.557527065 CET	1912	49756	87.120.120.86	192.168.2.9
Jan 11, 2025 04:57:09.557693005 CET	49756	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:09.570497036 CET	49756	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:09.575388908 CET	1912	49756	87.120.120.86	192.168.2.9
Jan 11, 2025 04:57:30.912101984 CET	1912	49756	87.120.120.86	192.168.2.9
Jan 11, 2025 04:57:30.912190914 CET	49756	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:30.935189962 CET	49756	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:35.957926035 CET	49924	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:35.962800026 CET	1912	49924	87.120.120.86	192.168.2.9
Jan 11, 2025 04:57:35.962867022 CET	49924	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:35.963116884 CET	49924	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:35.967895031 CET	1912	49924	87.120.120.86	192.168.2.9
Jan 11, 2025 04:57:57.340006113 CET	1912	49924	87.120.120.86	192.168.2.9
Jan 11, 2025 04:57:57.340117931 CET	49924	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:57:57.340383053 CET	49924	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:02.407208920 CET	49980	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:02.412307978 CET	1912	49980	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:02.414978981 CET	49980	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:02.415208101 CET	49980	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:02.419966936 CET	1912	49980	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:23.773108959 CET	1912	49980	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:23.773334026 CET	49980	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:23.774255037 CET	49980	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:28.785316944 CET	49981	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:28.790231943 CET	1912	49981	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:28.790321112 CET	49981	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:28.790657997 CET	49981	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:28.795547962 CET	1912	49981	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:50.166528940 CET	1912	49981	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:50.169106007 CET	49981	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:50.169229984 CET	49981	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:55.175848961 CET	49982	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:55.180656910 CET	1912	49982	87.120.120.86	192.168.2.9
Jan 11, 2025 04:58:55.180792093 CET	49982	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:55.181050062 CET	49982	1912	192.168.2.9	87.120.120.86
Jan 11, 2025 04:58:55.185864925 CET	1912	49982	87.120.120.86	192.168.2.9

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 5tCuNr661k.exePID: 2700, Parent PID: 3504

General

Target ID:	0
Start time:	22:57:06
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\5tCuNr661k.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5tCuNr661k.exe"
Imagebase:	0xa20000
File size:	877'568 bytes
MD5 hash:	12DEA314DB7AA2B97F2C43A4081D4F66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1380024284.0000000004BA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1380024284.0000000004BEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1380024284.0000000004801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: 5tCuNr661k.exePID: 1048, Parent PID: 2700

General

Target ID:	3
Start time:	22:57:07
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\5tCuNr661k.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5tCuNr661k.exe"
Imagebase:	0x5f0000
File size:	877'568 bytes
MD5 hash:	12DEA314DB7AA2B97F2C43A4081D4F66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2609693262.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 5tCuNr661k.exePID: 2700, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3%
Total number of Nodes:	297
Total number of Limit Nodes:	20

Executed Functions

Function 097FE4B8 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4074ad425185d562d423c178f9cc890c2279e365272a580a674924fdba60f4d
Instruction ID: 397907fa5f4fd119f6530f1b5e545ba076642c34182e08af85f8ec9e472e487e
Opcode Fuzzy Hash: d4074ad425185d562d423c178f9cc890c2279e365272a580a674924fdba60f4d
Instruction Fuzzy Hash: CF327B72B016059FDB24EFA5C464BAEB7F6AF89700F10846DE206AB3A0DB35DD01CB51

Function 014C1A71 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16f3d0984e95e33b261aabed597ae41b76dc0a61374bf66993dfd4eb5b5d302
Instruction ID: 2cb7ab6f7510c37ac700f99aeb1737cbc4d98079f9087ece75ad80715cecb54c
Opcode Fuzzy Hash: d16f3d0984e95e33b261aabed597ae41b76dc0a61374bf66993dfd4eb5b5d302
Instruction Fuzzy Hash: 6DC10138A14201CFC7E9CF24C9C58A6BBB2FF80B15715856FD042CB662D7B5E952CB89

Function 053C9AA0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5667a11effd2d04cea866c48f638c48d41900416ccccf8d2874fd836c91a9e8
Instruction ID: 3134147fd571bbf3edc6a5955f835594b0ba4c22726c34ac712d55f1e8eafc90
Opcode Fuzzy Hash: f5667a11effd2d04cea866c48f638c48d41900416ccccf8d2874fd836c91a9e8
Instruction Fuzzy Hash: 0FC16F31A002158FDB04EFA4C894AAEBBB2BF84300F1589A9E51AAF355DF70ED45CB51

Function 053C9A90 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94e26ba0c5265dc40c9b876a9838745a69a79f05cd52a98c62c8512c05b4738
Instruction ID: c4b6a7a5e19692c6dda7c52114c1a9d0b770794d13ff1b8c9f430e3af334c9d3
Opcode Fuzzy Hash: b94e26ba0c5265dc40c9b876a9838745a69a79f05cd52a98c62c8512c05b4738
Instruction Fuzzy Hash: 99B16E71A002158FDB04EFA4C894AAEBBB2FF84300F1589A9E50AAF355DF70ED45CB51

Function 014C1FE9 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25c5b5c8cef88d9aa5d5017e9b93afbcc9d9794b56cd791cebfe6af3507acb6
Instruction ID: 561d4638178ad431bdaf6f8c80f0836162ee244222ce705b108541baaa5a39c5
Opcode Fuzzy Hash: d25c5b5c8cef88d9aa5d5017e9b93afbcc9d9794b56cd791cebfe6af3507acb6
Instruction Fuzzy Hash: 72B1F038914301CFC3E9CF24C9D58A6BBB1FF41B15725856FD0428B662D7B5E942CB89

Function 014C1B4B Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a5ccb103c6934bcecd8724184ef43f86e2941f3f5610e726ad180cd80815a1
Instruction ID: 4c4a40d4a14f810d36a3cb04893ca8dca5a1fb22db5e0f87d0184655b0bf4a72
Opcode Fuzzy Hash: c7a5ccb103c6934bcecd8724184ef43f86e2941f3f5610e726ad180cd80815a1
Instruction Fuzzy Hash: 0BB1F138A14201CFC3E9CF24C9C5CA6BBB1FB40B15716856FD0428B672D7B5E956CB89

Function 014C1A45 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6a9338afd6622e6082b17f5ad0173da1696383ecff7105a98f31f22a4809ce
Instruction ID: 46a43968b0fda7c7039211baf751b345defcd1b00d47f8c5f914252d935f61f0
Opcode Fuzzy Hash: 7f6a9338afd6622e6082b17f5ad0173da1696383ecff7105a98f31f22a4809ce
Instruction Fuzzy Hash: 3DB10238A14201CFC3E9CF24C9C5CA6B7B1FF80B15716856FD0428B662DBB5E956CB89

Function 014C1C45 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32743b0e42126f7ee32638479ad0e5dd270038bfafb3d3d38f5a45301bab2b43
Instruction ID: 284124732d941984b0b43dbcd4faf64093ee7c35c6198276d40743609e99dc87
Opcode Fuzzy Hash: 32743b0e42126f7ee32638479ad0e5dd270038bfafb3d3d38f5a45301bab2b43
Instruction Fuzzy Hash: E1B1EF38A14201CFC3E9CF24C9C5CA6BBB1FF80B15716856FD0428B662D7B5E952CB89

Function 014C1BA3 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af17d598ce5869e6d969ba9c45db0a7cb4efdf3a4deccd901a69c7a53322a4f
Instruction ID: 8aa79c766acbadf88ca8515b09002a3b50d729af2ad9491082e91ca9be1bf820
Opcode Fuzzy Hash: 8af17d598ce5869e6d969ba9c45db0a7cb4efdf3a4deccd901a69c7a53322a4f
Instruction Fuzzy Hash: 67B1EF38A24301CFC3E9CF24C9D5CA6BBB1FB40B15716456FD0428B662E7B5E952CB89

Function 014C1FFE Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ddb111ca65f38c2666fb4b5af97d1cc5ceec0e9ae4b35d67f98239cf92c3b2
Instruction ID: de4a7cb9297320b0cc01bb757ef10f11eeb1743df039c3b7c0a75c713ab57049
Opcode Fuzzy Hash: d8ddb111ca65f38c2666fb4b5af97d1cc5ceec0e9ae4b35d67f98239cf92c3b2
Instruction Fuzzy Hash: F6B1F038914301CFC3E9CF24C9C5CA6BBB1FB40B15716456FD0428B662D7B6E952CB89

Function 014C1E0A Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7e77ae18cdeea99e027cf3565c7dd99692c99e993e0b6b9ef6067faaffba18
Instruction ID: 4bf6e08ba54943a1b1ab8e8bdffada72a96ee395eb6efd6a5833d7ce2fe230dd
Opcode Fuzzy Hash: 2c7e77ae18cdeea99e027cf3565c7dd99692c99e993e0b6b9ef6067faaffba18
Instruction Fuzzy Hash: 84B1FF38A14301CFC3E9CF24C9C5CA6BBB1FB40B1571685AFD0428B662D7B5E956CB89

Function 014C1EFA Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bea5f70a7b442e710ab912f2645199622296d4abc5aa21ecebe09988ed4c24f
Instruction ID: e269e125c33c75b7c78e9d517b8f7024ca579fddbec35a4f37e865c544073ebc
Opcode Fuzzy Hash: 8bea5f70a7b442e710ab912f2645199622296d4abc5aa21ecebe09988ed4c24f
Instruction Fuzzy Hash: 6BB1FF38A14201CFC3E9CF24C9D5CA6BBB1FF40B15716856FD0428B662D7B5E952CB8A

Function 014C22C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6563ee860da3794b9412024c1d087c01d981d63ce9f0e6d3329c53853a2f2e2b
Instruction ID: 7ad818ffde455b27156cb42b0105b64f2a1e228178b1089b13f955001e986391
Opcode Fuzzy Hash: 6563ee860da3794b9412024c1d087c01d981d63ce9f0e6d3329c53853a2f2e2b
Instruction Fuzzy Hash: 35B12C39A14202CFC399CF29C985866BBB5FB40B00712856FE016CF6A1D7F5ED12CB89

Function 014C0CCD Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cc7047314ee5d4b47dfa6b5b0b406f49680d03d6f0469a618517318d6fc6a1
Instruction ID: 0245600a9d4fc8927b0711d6c7a510f57e3c694909b013d1889336eee3d3029e
Opcode Fuzzy Hash: 51cc7047314ee5d4b47dfa6b5b0b406f49680d03d6f0469a618517318d6fc6a1
Instruction Fuzzy Hash: 2981D074A01245CFC7A4CFA9C8959AEBBF1FF45714B1080AFE455AB262D7329C06CF91

Function 014C0A85 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed4d8d377926f1e9a5ac00bd27d540d10f33b5fc60a951a80a6e10e2cb47102
Instruction ID: c8d5697d453840d597883900d8b82321c34fb2de79cdcf2040c6f21e5ef0b479
Opcode Fuzzy Hash: eed4d8d377926f1e9a5ac00bd27d540d10f33b5fc60a951a80a6e10e2cb47102
Instruction Fuzzy Hash: 6D81DF74A01245CFC7A4DFA9C8959BEBBF1FF45714B2080AFD455AB262D7328C02CB91

Function 014C0BD3 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ce9389e0699b5e6e16467e03e12f33e017123f219429bdaab658a8b4fd6453
Instruction ID: e9d3ec27129ea291d876e79ae4c87788a0e8935356a9097696a44c0d1072c265
Opcode Fuzzy Hash: d6ce9389e0699b5e6e16467e03e12f33e017123f219429bdaab658a8b4fd6453
Instruction Fuzzy Hash: 5281D174A01245CFC7A4DFA9C8959AFBBF1FF45710B1080AFD055AB262D7328C06CB91

Function 014C094A Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257a1cd0d987740a22af37fdcfc5c61dd417e2b090c3e4b956a780b92484b085
Instruction ID: 3de3eed949c86b9eba760217fa81b921f9aa99e45b7974f06a11ffab6b9be67f
Opcode Fuzzy Hash: 257a1cd0d987740a22af37fdcfc5c61dd417e2b090c3e4b956a780b92484b085
Instruction Fuzzy Hash: 7F71C074A11245CFCBA4DFA5C8959BEBBF1FF45710B2080AFD445AB262D7318D02CB51

Function 014C08CE Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af026b874e0e0fd3b30375a6b0b5bd0b231127b2f923cffa05cbe8629b9042e
Instruction ID: 610e17d5a8803a62c2194f74ead92c5b1d8833c001cb363b4da1b39f5563df07
Opcode Fuzzy Hash: 0af026b874e0e0fd3b30375a6b0b5bd0b231127b2f923cffa05cbe8629b9042e
Instruction Fuzzy Hash: C371D074A01245CFCBA4DFA5C8959BEBBF1FF45710B2480AFD045AB262D7328D06CB91

Function 014C08FF Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fff841050cec3fee1a1c36ad87f2fe053b45434bf44e6bf99aa77599f1fbe5
Instruction ID: 73ae238980c28cf1cae93c4652483296317389f6a9cd265952e5afa90649dd5b
Opcode Fuzzy Hash: 84fff841050cec3fee1a1c36ad87f2fe053b45434bf44e6bf99aa77599f1fbe5
Instruction Fuzzy Hash: A681D174A00245CFCBA4DFA5C895ABEBBF1FF85714B1080AFD045AB262D7318D02CB51

Function 014CA54B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8011c4122765d9e3d71579ddc3a7035cde61822310e305973d019c3d3fd369d
Instruction ID: f3ec56f0cee36afc185aedadaa7df02a599c5c7cd3924eae6481b25521916478
Opcode Fuzzy Hash: b8011c4122765d9e3d71579ddc3a7035cde61822310e305973d019c3d3fd369d
Instruction Fuzzy Hash: 5B611638B047058BCB84ABB8C85466EBBA3ABD5604B10C93FD046DF3A5DF34DD068795

Function 014C0E04 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cffdd987280316a14218643384eb26f8d2d2ac206dc5c6254396c66be8ea9d7
Instruction ID: ffe0256cc59aa338347900a1a780b9d96ea589a57f40d1f5a2eec10c7c1082a0
Opcode Fuzzy Hash: 1cffdd987280316a14218643384eb26f8d2d2ac206dc5c6254396c66be8ea9d7
Instruction Fuzzy Hash: 3171D074A11245CFC7A4DFA9C8999BEBBF1FF45314B2080AFD055AB262D7328D06CB91

Function 014C0EAB Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5408ef7407eb83ff0e5f38c8b6e92776a1e022b052420343139f44b6e27c049
Instruction ID: 6b184f58bd295a2cfb1a5a05986879e1a6504575ec6931ffc77c6894d974ebb6
Opcode Fuzzy Hash: e5408ef7407eb83ff0e5f38c8b6e92776a1e022b052420343139f44b6e27c049
Instruction Fuzzy Hash: 8B71D174A11245CFC7A4DFA9C8999BEBBF1FF45314B24809FD055AB262D7328C06CB91

Function 014C09AB Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c06bad6d37acc78c24732648475027edb2195c6a3ca4d348f492669a982c4d
Instruction ID: d7de7e65fc0bba60b64f1cd14f221a6b07a2f7fdfe7c04555f02881468c23b48
Opcode Fuzzy Hash: 98c06bad6d37acc78c24732648475027edb2195c6a3ca4d348f492669a982c4d
Instruction Fuzzy Hash: 7171C074A11245CFC7A4DFA9C8959BEBBF1FF45314B2080AFD055AB262D7328D06CB91

Function 014C0B9F Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e6309ca6d551645e7f77031796ef196f5c987328c0bc842b3098d2ce05b190
Instruction ID: 44cb0756870b774c361172a0135cb3d68a82bacae39a8ba61bfa21117e5b4120
Opcode Fuzzy Hash: 77e6309ca6d551645e7f77031796ef196f5c987328c0bc842b3098d2ce05b190
Instruction Fuzzy Hash: 3E71CF74A01245CFC7A8DFA9C8999BEBBF1FF45310B2080AFD055AB262D7318D06CB91

Function 014C0A0C Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2985aa6bbd339d7e273db4f614741e18b6e2374e666002d1143700406fd50cc6
Instruction ID: af43cd0ac2ca626d2995a1c4c7e0b987207de066ae3f1d0ecdf5e3b44f5789c8
Opcode Fuzzy Hash: 2985aa6bbd339d7e273db4f614741e18b6e2374e666002d1143700406fd50cc6
Instruction Fuzzy Hash: 2E71CF74A01245CFC7A8DFA9C8959BEBBF1FF45314B2080AFD455AB262D7328D06CB91

Function 014C0C99 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfc3310d4715ad56a325426e067f1997bf3f4e0a1bdc946a854b94b1209ede3
Instruction ID: e77cd282687b72c997d571d936a7434ac8427f73e89b1c3f73f094cb8dc7ac64
Opcode Fuzzy Hash: 1dfc3310d4715ad56a325426e067f1997bf3f4e0a1bdc946a854b94b1209ede3
Instruction Fuzzy Hash: D471D074A01245CFC7A8DFA9C8959BEBBF1FF45314B1080AFE055AB262D7318D06CB91

Function 014C097E Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34da7cd71e3cbd9a90d93b4500c8bb11eabd4922a18dce88244d808b8ab908e7
Instruction ID: 9a6cffce359effaba11c4445f22c30880dd63e224b99980fbbcccd66d4517ea3
Opcode Fuzzy Hash: 34da7cd71e3cbd9a90d93b4500c8bb11eabd4922a18dce88244d808b8ab908e7
Instruction Fuzzy Hash: EA71C074A11245CFCBA8DFA9C8959BEBBB1FF45314B20409FD045AF262D7318D02CB95

Function 014C09DF Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f68039057f401cc126c65b7702d322019730eeb42c3de1de56565fc46d7e44
Instruction ID: af40ca98874c9dd2c71f26461cf9b913086ecabd8ce4831d95e97528212f2d1a
Opcode Fuzzy Hash: f0f68039057f401cc126c65b7702d322019730eeb42c3de1de56565fc46d7e44
Instruction Fuzzy Hash: 1271C074A11245CFCBA8DFA9C8959BEBBB1FF45314B20409FD045AF262D7358D06CB91

Function 014C0D67 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f033c7c579130bcb7e9c8d06c8cff7639894ad2552d5f0d18c0293b1b9fe79aa
Instruction ID: 99dab7bf71d6e470126b0c1436a723b2d4abb1e7548eb92d1b5c3329f978ce81
Opcode Fuzzy Hash: f033c7c579130bcb7e9c8d06c8cff7639894ad2552d5f0d18c0293b1b9fe79aa
Instruction Fuzzy Hash: 0971D074A11245CFCBA8DFA9C8959BEBBB1FF45314B20409ED045AB262D7318D06CB91

Function 014C0B1B Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa27844fb633f74b93f948c42b35a0f09dc45e3bdda7eb34b7ef8e4149a665b
Instruction ID: 424f97d0cbeb34c7148c4c535aff34bcc50f53e859832d13d98cb9cf554a5707
Opcode Fuzzy Hash: 7aa27844fb633f74b93f948c42b35a0f09dc45e3bdda7eb34b7ef8e4149a665b
Instruction Fuzzy Hash: D071D074A10245CFCBA8DFA5C8959BEBBF1FF45314B2040AED445AF262D7318D06CB95

Function 014C7408 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bcaa39e20b9ca40884476982e3762455cf48f9d7c932b97d933f271cbeda6e3
Instruction ID: c03cab23615069f30d61eb6fdaf2f6ee2a7a3d9dcb884b5d60c48927997f0ff5
Opcode Fuzzy Hash: 4bcaa39e20b9ca40884476982e3762455cf48f9d7c932b97d933f271cbeda6e3
Instruction Fuzzy Hash: A461E438B047058BCB88ABB8C95566FA7A7ABD4704F10C93ED046DB3A4DF34DD068795

Function 097FC838 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff327b3d61411a49bcc86bb5415219a1acb80ebeed7e09fe87fef3aeb2039fa
Instruction ID: 379463b6fcb18f1d8a04f31981a72d621759115c671150ecd2d500acbaa3a3c9
Opcode Fuzzy Hash: cff327b3d61411a49bcc86bb5415219a1acb80ebeed7e09fe87fef3aeb2039fa
Instruction Fuzzy Hash: F2511672D056198FEB28CF66C8507E9FBB6BF8A300F14C1AAD549B6254EB701A85CF40

Function 053C09B0 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 053C0A3E
GetCurrentThread.KERNEL32 ref: 053C0A7B
GetCurrentProcess.KERNEL32 ref: 053C0AB8
GetCurrentThreadId.KERNEL32 ref: 053C0B11

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eee6a5b328948e0f1f23fbe520bbc55d0dc2323b1427db0c7342f3dbda1a764a
Instruction ID: 75e2a98a93ca79cf2f305ed8d1366dd3edb383abf6e1c08b8de520dbbe0acb57
Opcode Fuzzy Hash: eee6a5b328948e0f1f23fbe520bbc55d0dc2323b1427db0c7342f3dbda1a764a
Instruction Fuzzy Hash: 165186B0901749CFDB54CFA9C948BEEBBF1AF88300F208469E049A7391DB749C45CB65

Function 053C09C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 053C0A3E
GetCurrentThread.KERNEL32 ref: 053C0A7B
GetCurrentProcess.KERNEL32 ref: 053C0AB8
GetCurrentThreadId.KERNEL32 ref: 053C0B11

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ea2c0030aafb6f78b65f57a88585047767f83388ec3393c368449ec11a8331c4
Instruction ID: 0ab0d3ba4503b3486af02a9e9b4e624705bbf066748bbbe11c4cf47634ab2d34
Opcode Fuzzy Hash: ea2c0030aafb6f78b65f57a88585047767f83388ec3393c368449ec11a8331c4
Instruction Fuzzy Hash: D15165B0901749CFDB58CFAAC948B9EBBF1BF88304F208469E049A7390DB749D44CB65

Function 097FB70E Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 097FB94E

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ab9a5f7460fb4b92498994af1787ec52ede6d63cc22d7e372b813c6637ad75fd
Instruction ID: 76cef69f6ae9e06c3addc504b311904b0ef157d2708f6ba5cf8961909f8fe96d
Opcode Fuzzy Hash: ab9a5f7460fb4b92498994af1787ec52ede6d63cc22d7e372b813c6637ad75fd
Instruction Fuzzy Hash: EDA13B72D00319DFEB24CFA8C8517AEBBB2BF84310F14816AE959B7250DB749985CF91

Function 097FB718 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 097FB94E

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bbc58969a00c38a9187546198d517d8c2720eae4067c0ed24f7b4251d5dc4d0a
Instruction ID: 56eedb3ed992b3d1632578bdf60f9771babae80e6b86a944f1b4293824455808
Opcode Fuzzy Hash: bbc58969a00c38a9187546198d517d8c2720eae4067c0ed24f7b4251d5dc4d0a
Instruction Fuzzy Hash: 9E914B72D00319CFEB14CFA8C8517AEBBB2BF84310F14816AE959B7240DB749985CF91

Function 053C5138 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053C52A2

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: be37da3384a9c086e5bcda901db6632fa6e8e2ed69755d507c788ba7dd3a4f5a
Instruction ID: 32c5d0cf15eee2d1e4b1e900fe51577242b6b302ac70cb725aa6c76445228483
Opcode Fuzzy Hash: be37da3384a9c086e5bcda901db6632fa6e8e2ed69755d507c788ba7dd3a4f5a
Instruction Fuzzy Hash: CF51BEB1C00209AFDF15CF99D884ADDBFB6BF48300F14816AE919AB220D775A895CF50

Function 053C518D Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053C52A2

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 181667207d9587f302266eda85f82fd069b10c6d2babd193df53fb74164d8c56
Instruction ID: 52760e8ee5d0254796dbf77843045b377f245df5863ef7dcb3af24101e3ca045
Opcode Fuzzy Hash: 181667207d9587f302266eda85f82fd069b10c6d2babd193df53fb74164d8c56
Instruction Fuzzy Hash: F751A3B1D103499FDB14CF99D884ADEBFB5BF88310F24816EE819AB210D7B5A845CF50

Function 053C5190 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053C52A2

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3989a990031c4d2c2eb14cdd46d15b523b2b5e0885aceeb24f73dc21642367cc
Instruction ID: 84eb5c5742287f5bb08164f95f21f155cf64d2a2dd61a0793aea1da01a3fa3c9
Opcode Fuzzy Hash: 3989a990031c4d2c2eb14cdd46d15b523b2b5e0885aceeb24f73dc21642367cc
Instruction Fuzzy Hash: 6141A0B1D103499FDB14CF99C884ADEBFF5BF88310F64812AE819AB210D7B5A845CF90

Function 014C8EBC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014C8F79

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d68fdd8ded1b212e9d7ab758663e193a4d2556a6850355b388fb590843e651f3
Instruction ID: 7e0661d7c22fc0f569fe3718146773784242099714b4477a31277f50ea1ae03a
Opcode Fuzzy Hash: d68fdd8ded1b212e9d7ab758663e193a4d2556a6850355b388fb590843e651f3
Instruction Fuzzy Hash: CE41E1B0C00719CFEB24CFA9C844BDEBBB5BF49704F20806AD548AB261DB756946CF90

Function 053C314C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 053C7821

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b1befebe9461f57f7960294ec65583c6f2df63c2e1ebc14fec8bf3095b84472c
Instruction ID: 786f56ea883df97c9208ba3fa2ccfabf1d3b6701208d115537ffddd165526ace
Opcode Fuzzy Hash: b1befebe9461f57f7960294ec65583c6f2df63c2e1ebc14fec8bf3095b84472c
Instruction Fuzzy Hash: 364129B9900709CFCB14CF99C488AAABBF5FF88314F15849DD559AB321D775A841CFA0

Function 014C7A4C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014C8F79

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2b95900002f2e10c3b3c14b4acd7f9384a053a86adf81ca0dca19eef6c5f2b61
Instruction ID: 665bb7397a345850804809d5b98ffd1ff17832681b8abe0a0ec9d830c094a42c
Opcode Fuzzy Hash: 2b95900002f2e10c3b3c14b4acd7f9384a053a86adf81ca0dca19eef6c5f2b61
Instruction Fuzzy Hash: 0D41E2B4C00719CFEB24CFA9C844B9EBBB5BF48704F20806AD558AB251DBB56946CF90

Function 097FB488 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 097FB520

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1a1dc708188413360df313acfd7492dc33ed13fbbdabe49dfab66c3be3ea6e75
Instruction ID: 6a6957d7127f95566ceb28da101c5dfe5c6d2d8eb972d824e8c2ba45dba649b9
Opcode Fuzzy Hash: 1a1dc708188413360df313acfd7492dc33ed13fbbdabe49dfab66c3be3ea6e75
Instruction Fuzzy Hash: 682135719003499FDB10CFA9C885BEEBBF1FF48310F14842AE959A7240C7789945CBA4

Function 097FB490 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 097FB520

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6ebb62f8870392951a2bca59acc0931ff6c3a58d26fca8a15329c4eb37589e4e
Instruction ID: 1ae41318bc201df7df56af13b4520c63251c47dfac0e3a79ffb50037aa778541
Opcode Fuzzy Hash: 6ebb62f8870392951a2bca59acc0931ff6c3a58d26fca8a15329c4eb37589e4e
Instruction Fuzzy Hash: 012126759003499FDB10CFAAC885BEEBBF5FF48310F14842AE959A7241C7799944CBA4

Function 053C0C00 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 053C0C8F

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6053219956253bcaf5d93d958369a3d7ba70249dd032d410f34f82e3fc6c5701
Instruction ID: 53207dff371cc7748f3383ac67e313344cbd3dca7ad0a46b0b00d0905787169b
Opcode Fuzzy Hash: 6053219956253bcaf5d93d958369a3d7ba70249dd032d410f34f82e3fc6c5701
Instruction Fuzzy Hash: 2921E6B5900258DFDB10CFAAD884AEEBFF4FB48310F14846AE999A7351C3759945CF60

Function 097FB2F2 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 097FB376

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 77fd9c43a90bea810317b18e48bd23e8231b12050caa994e6b716e8e63a2272a
Instruction ID: 971db3ebb9bdbec5b3514ad77ab0d54146cb45bee7f7ae9310ab0cee756914c7
Opcode Fuzzy Hash: 77fd9c43a90bea810317b18e48bd23e8231b12050caa994e6b716e8e63a2272a
Instruction Fuzzy Hash: 75213472D003098FDB14CFAAC4857EEBBF4EF88310F54842AD559A7241CBB89949CFA4

Function 097FB57A Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 097FB600

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c5bc289256475f022fed734e374ec9379256127ef0f4eee086bc5e74be0b26dc
Instruction ID: 74748f261f28dd199097948b0be58dad121cb7c8982868d6d8a71eb74c6e8db1
Opcode Fuzzy Hash: c5bc289256475f022fed734e374ec9379256127ef0f4eee086bc5e74be0b26dc
Instruction Fuzzy Hash: 562127B18003499FDB10CFAAC845BEEBBF5FF48310F14842AE559A7250C7749945CBA4

Function 097FB2F8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 097FB376

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 52a4c361ad8dfb5cafeefff668f35b10fde955e7131d79d80cb04ed6e2a736a5
Instruction ID: edfef26095d2cc3ece143b7dc1d87f9975bfda3b8e09a553751ac39553175f76
Opcode Fuzzy Hash: 52a4c361ad8dfb5cafeefff668f35b10fde955e7131d79d80cb04ed6e2a736a5
Instruction Fuzzy Hash: 872135729003098FDB10DFAAC8857EEBBF4EF48310F54842AD559A7241CBB89945CFA4

Function 097FB580 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 097FB600

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8149f7cbf9011f61b986c62f35008d3fca52b66d852250d4fd8652fd34f03153
Instruction ID: 7a83c893004d8a58b03cbd55f1441379c7109f2d49d2adef93dc7f64f8fbbc95
Opcode Fuzzy Hash: 8149f7cbf9011f61b986c62f35008d3fca52b66d852250d4fd8652fd34f03153
Instruction Fuzzy Hash: 2D2125B18003499FDB10DFAAC885BEEBBF5FF48310F54842AE958A7241C7799941CBA4

Function 053C0C08 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 053C0C8F

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e0f0e0fce54d53c67fdd86cc5ee831da730b67f0864500bc1dedb3a8682dddd6
Instruction ID: bee4058a732a487c7564b1ac84287a5a4cee6fbb1559105e669f654edea7f5a2
Opcode Fuzzy Hash: e0f0e0fce54d53c67fdd86cc5ee831da730b67f0864500bc1dedb3a8682dddd6
Instruction Fuzzy Hash: 6721E4B5900248DFDB10CF9AD884ADEBBF4FB48310F14842AE958A7350D374A944CF64

Function 053C4F58 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053C52A2

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 604adf22786e075dc5887a845234b0078b63c19d474b3f4fe1a64ff233df292e
Instruction ID: c86d7de21e086429055a44f985d4a23601c9cfb4198811ae06c16d1185c226bb
Opcode Fuzzy Hash: 604adf22786e075dc5887a845234b0078b63c19d474b3f4fe1a64ff233df292e
Instruction Fuzzy Hash: 8A21BE71800208EFDF15CF94D894ADDBFB5FF48304F248159E809AB260C7B5A845CF60

Function 097FB3C8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 097FB43E

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b39819b724e742c95fff8b151b778c6499ffd1749c6f05876c6a1a390ba7175e
Instruction ID: eb345e2cf718c77be2890d52bae36fc78e0a40e16dd14eba02d43b2c65dc95a5
Opcode Fuzzy Hash: b39819b724e742c95fff8b151b778c6499ffd1749c6f05876c6a1a390ba7175e
Instruction Fuzzy Hash: 4A1147718003489FDB10CFAAD844BEEBBF5EB88310F24842AE959A7250C7759955CFA0

Function 097FB3D0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 097FB43E

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b982a0692c0c267459d1f4d82b91c3d02f319c6d3e9daaa7f452d179b4d7256c
Instruction ID: 5caeda3b491e6e739b770b19d8de60d1a8db66b7e3106bee6ab7eae89ba2318e
Opcode Fuzzy Hash: b982a0692c0c267459d1f4d82b91c3d02f319c6d3e9daaa7f452d179b4d7256c
Instruction Fuzzy Hash: E51137728003489FDF10DFAAC844BEEBBF5EF48314F148429E959A7250C7759954CFA4

Function 097FA9D0 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 097FAA3A

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 63ae04373bdd1b291f6a4b548cd23f08e93d252b661d5013dfb0a6c000ee4658
Instruction ID: 0d9dceba3efd4cf2f9f01802ed08095e3cc01ddc0331cd269dce50ff42c2d3e1
Opcode Fuzzy Hash: 63ae04373bdd1b291f6a4b548cd23f08e93d252b661d5013dfb0a6c000ee4658
Instruction Fuzzy Hash: C81188B19003088FDB24CFAAC8457EEBBF1EB88310F14842AD559B7350CB79A945CFA4

Function 097FA9D8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 097FAA3A

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d87eeca8dbc9c4a6197c0110b251ed7062362e7c9127ec6f9ded7cac4b604e0a
Instruction ID: e3f3c97be5d5f15b2658a8a34ef26b6866abf8ed31a3e2e31ea7c9de774aa2a5
Opcode Fuzzy Hash: d87eeca8dbc9c4a6197c0110b251ed7062362e7c9127ec6f9ded7cac4b604e0a
Instruction Fuzzy Hash: 711128B19003488FDB24DFAAC84579EFBF4EB88314F148429D559A7240CB75A945CBA4

Function 097FD6F4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 097FDDD5

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1f65dc4116facd283e9c782c1bb724108028c5c96cb569a5c1aa401d53c7e370
Instruction ID: 98b1b81baee0ec065152a7c22d823f7fcc9ffa87d976500b865b4fc146965ac5
Opcode Fuzzy Hash: 1f65dc4116facd283e9c782c1bb724108028c5c96cb569a5c1aa401d53c7e370
Instruction Fuzzy Hash: 6711E0B58007489FDB20CF9AC848BEEBBF8FB48310F10845AE958A7740C375A944CFA1

Function 014CE798 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014CE7FE

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3d586cb6a69f320879e4dde7e555dd869030a71642ee4f6a5d1d82dee7c703f1
Instruction ID: 9669e3a09b182578ef6fd90aa8fcf831ce5b12771c6c779e9a8f6b4e9d96bbbf
Opcode Fuzzy Hash: 3d586cb6a69f320879e4dde7e555dd869030a71642ee4f6a5d1d82dee7c703f1
Instruction Fuzzy Hash: AF1102B5C006498FDB10CF9AC844BDEFBF4AB88610F10842AD459B7210C375A545CFA1

Function 010ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375346598.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ed000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e64a3af51d412b366878078b3e0f9c62a627fe7c514de2d79f98d2cc7c6614a
Instruction ID: 8fe5b33e647f47b7d816c2976e11385348b2acb86ead1c220054968708411f9c
Opcode Fuzzy Hash: 5e64a3af51d412b366878078b3e0f9c62a627fe7c514de2d79f98d2cc7c6614a
Instruction Fuzzy Hash: BA210071604300DFDB15DF94D888B26BFE1EB88314F28C5ADE88A0B242C336D456CB62

Function 010ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375346598.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ed000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e84cf7ce0cef1a4dc027f43f6de4f19abd34472253e9b4cdc986a4b2aa0b8bb
Instruction ID: 7bb730826b76a502b673cd159549ca92a9b72e0b443922a2dd385f6150df19b6
Opcode Fuzzy Hash: 8e84cf7ce0cef1a4dc027f43f6de4f19abd34472253e9b4cdc986a4b2aa0b8bb
Instruction Fuzzy Hash: C32195755093808FCB13CF64D594715BFB1EB46214F28C5DAD8898F667C33A980ACB62

Function 010DD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375267217.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10dd000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d42ade5c4549658ff52ce76989d12ca1a7f62b905bfc41d847e29416520660
Instruction ID: bf5b03a610b8118807070ce10132ad6bfef2b5b67249f7e8e0a3f48be8ebe144
Opcode Fuzzy Hash: f7d42ade5c4549658ff52ce76989d12ca1a7f62b905bfc41d847e29416520660
Instruction Fuzzy Hash: 5A01A7310083849BE7544BA5CD84B6AFBD8FF41224F19C49AED894A1C2E6789844CB72

Function 010DD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375267217.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10dd000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51babc7c5da2655db861d13c138aeef0e3c83ed1b977d30432bf4d348a63c2d
Instruction ID: 2a3370a826962b39f299f49da17daa87f58e3af9879ec60751f1bcf410b48ffb
Opcode Fuzzy Hash: f51babc7c5da2655db861d13c138aeef0e3c83ed1b977d30432bf4d348a63c2d
Instruction Fuzzy Hash: ACF062714083849FE7548B1ADD84B66FFD8EB81734F18C59AED884F283D2799844CB71

Non-executed Functions

Function 014C2BA8 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

Ea, xrefs: 014C2C3A

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID: Ea
API String ID: 0-3364303221
Opcode ID: 23d6c27b962450cf677978b867c8f693919cdf8a704deded5987e4e52b530083
Instruction ID: 82481cf8867fdf6ecb004f339392b9b68498914d6661818cdbf6fd523c486881
Opcode Fuzzy Hash: 23d6c27b962450cf677978b867c8f693919cdf8a704deded5987e4e52b530083
Instruction Fuzzy Hash: 3E41D335614606CFC794CE69D981A66BBF6FF84310B14C82FD05ADB664E2B4D945CB01

Function 014C2BB8 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

Ea, xrefs: 014C2C3A

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID: Ea
API String ID: 0-3364303221
Opcode ID: 28567bb967bd3485023f0af3c24930d51f078e075858a1c1f7dea6389b48ccf7
Instruction ID: c04f75822a41137a67695d8d40aff096122f21f2b93dc5a1bb9684d7d2975935
Opcode Fuzzy Hash: 28567bb967bd3485023f0af3c24930d51f078e075858a1c1f7dea6389b48ccf7
Instruction Fuzzy Hash: 2E41D235710606CFC7A4CE69D985E6BBBF6FB84610B14C42FD01ADB664E2F4E981CB42

Function 053C38E0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79e527a23ffff0e23b7405020da46b6c5428a6c5d024ad50301e514575b1b0c
Instruction ID: 240e807bce8c3d70bdef31db7c3a40ac7ccd63824ecfa4ae1e35e4a87c96e689
Opcode Fuzzy Hash: f79e527a23ffff0e23b7405020da46b6c5428a6c5d024ad50301e514575b1b0c
Instruction Fuzzy Hash: 3D1250B0402B858AE730CF65E94C2893BB1BB85358B51830DD2666E3F9DBB8156BDF44

Function 097FAEC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1391038367.00000000097F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97f0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff99be9de23fdcec60a33974aaaf49b9e201431292a1d94c47a8e34c5e5d03c7
Instruction ID: 9480a94571cc3607471640f77bbe25b411cc4b0b9f39a83c6f5e3d03c79ebe7b
Opcode Fuzzy Hash: ff99be9de23fdcec60a33974aaaf49b9e201431292a1d94c47a8e34c5e5d03c7
Instruction Fuzzy Hash: 15E12775E002198FDB14DFA9C590AAEBBB2FF89301F248169D558BB356D730AD42CF60

Function 053CE921 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05afe6ff6a0670f28d76810f0a572ab69a2e111b6b90f94c174a48dc760e6954
Instruction ID: 742ac99e24a62cb881735d5fb45c6c58cd826568031d01f518aebb139d8cfb12
Opcode Fuzzy Hash: 05afe6ff6a0670f28d76810f0a572ab69a2e111b6b90f94c174a48dc760e6954
Instruction Fuzzy Hash: 42D1E63582075A8ACB10EBA5D9906DDB7B1FF99300F50D79AE0493B254EF70AAC4CF91

Function 053CE930 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f610c5d9aff57a0525ce36b1be7efb75654cb749dc3d353245bd7333ddfd1046
Instruction ID: 32fc9010d11e5c2b5a445f02a919743b5a4b9d6849eae9d44ebe81b9e4e03a5f
Opcode Fuzzy Hash: f610c5d9aff57a0525ce36b1be7efb75654cb749dc3d353245bd7333ddfd1046
Instruction Fuzzy Hash: 58D1E63582075A8ACB10EBA5D9906DDB7B1FF99300F50D79AE0493B254EF70AAC4CF91

Function 053C12C4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798d02dad383ed348f9ba178abf684646eee27061964134a2aef778549540ca3
Instruction ID: 1ba1fbf9a4eb7363cbdcabad684b2c0d7a096383437989b8e1926852b146a0a0
Opcode Fuzzy Hash: 798d02dad383ed348f9ba178abf684646eee27061964134a2aef778549540ca3
Instruction Fuzzy Hash: CFA17D36E006098FCF15DFB4C84459EBBB2FF85304B1545AEE806AB225DB71ED55CB90

Function 053C38D0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389320608.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465fdb93569af59ec448e8a73d65fc072f75870a63a0a28c9e62295475d503f3
Instruction ID: d96686e9eabc1270c3bfd21e85e3d7fd02314b63b45716db3af586b54440857d
Opcode Fuzzy Hash: 465fdb93569af59ec448e8a73d65fc072f75870a63a0a28c9e62295475d503f3
Instruction Fuzzy Hash: E9C1C6B0812B858BE720DF65E8482897BB1BB85324F51830DD2626F3F9DBB4146BDF54

Function 014C3600 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236de53cbc18e63c20d09c8795f2d057482add221f092a5cd6de84d33e801ebc
Instruction ID: 32840914dc629ffe93a7484695e942e724bf98648e144a3bcf023431a986ee63
Opcode Fuzzy Hash: 236de53cbc18e63c20d09c8795f2d057482add221f092a5cd6de84d33e801ebc
Instruction Fuzzy Hash: 3B71DF75F1420A8FCBA4CF59C9855AEFBF1BB88610F55C12BD509EB361D234DA02CB92

Function 014C3719 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955e00946eebc4733d883dca4334fd0651a7fb64ad6bfcad734a089e7a0b328b
Instruction ID: 910a182a767f9c88f853d5b5d65d38e4e23d4b3ad0706dfd614d617fcec5178e
Opcode Fuzzy Hash: 955e00946eebc4733d883dca4334fd0651a7fb64ad6bfcad734a089e7a0b328b
Instruction Fuzzy Hash: CF416F79F152098FCB80CF59C9855AEBBF6BF89A10B15C12BE915EB361C234D901CF91

Function 014C309D Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323d1ed295eeb3e05c7c8ee24b71f333ec1f9dc5e4ed1c1b48198f64b7ee628d
Instruction ID: 200212385f2f4da89cfb8a6c0967f53fba91ef78c0fef31cdab4f2f91d936807
Opcode Fuzzy Hash: 323d1ed295eeb3e05c7c8ee24b71f333ec1f9dc5e4ed1c1b48198f64b7ee628d
Instruction Fuzzy Hash: 8431F235A083818FC759CF28D94166ABFB2FB81610B2586AFD045CF657CB31DA0ACB81

Function 014C3167 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601e9e4ea5a222c0038f18e444b7b7aa3dde301943285332b9e3f43f0879ca72
Instruction ID: 676db6a7ad9a3825a0a829c404bfb7ccdd3edb4215401f5a725c811ecacc9bcd
Opcode Fuzzy Hash: 601e9e4ea5a222c0038f18e444b7b7aa3dde301943285332b9e3f43f0879ca72
Instruction Fuzzy Hash: FC31D235A083818FC759CF78D94166A7FB2FB81614B1989AFD041DF663DB71CA0AC782

Function 014C35F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376387390.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14c0000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213bf92e92e94361ad589c58b1ebc615d515a57c096e364a6637f79390262e70
Instruction ID: 9bff8bc79e520e65aeaf985a9261aef48b2c4887732ba33e353d44e3857e7c63
Opcode Fuzzy Hash: 213bf92e92e94361ad589c58b1ebc615d515a57c096e364a6637f79390262e70
Instruction Fuzzy Hash: 99212731F041068BCBA8CE59C9815BFFBB5BB90610F12C12BD409EB361D375DE428B91

Analysis Process: 5tCuNr661k.exePID: 1048, Parent PID: 2700COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	6

Executed Functions

Function 00DBAE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DBB086

Memory Dump Source

Source File: 00000003.00000002.2610631552.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_5tCuNr661k.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7ee5b5dfcfa98baab3e27d71a7f21c8fac747bee5594ac67925279236424fcf6
Instruction ID: 5297efa0f21ad9ded28d5330b14ae79741954e7d7ff5bcb5f0b6031a189df16e
Opcode Fuzzy Hash: 7ee5b5dfcfa98baab3e27d71a7f21c8fac747bee5594ac67925279236424fcf6
Instruction Fuzzy Hash: 467136B0A00B05CFDB24DF2AD0457AAB7F1FF88314F04892DE48A97A40D775E946CBA1

Function 00DB5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB59F1

Memory Dump Source

Source File: 00000003.00000002.2610631552.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_5tCuNr661k.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cc3a4e643f93a0919ed5251ddf1d942c917845999af02d06370e3eac8a38f771
Instruction ID: d6e5984a557db3f04c3f4cc4fd39322c80823a39cda7f76f19d1aed7a927c3f9
Opcode Fuzzy Hash: cc3a4e643f93a0919ed5251ddf1d942c917845999af02d06370e3eac8a38f771
Instruction Fuzzy Hash: 0D41EFB0C00719CBDB24CFAAC884BDDBBB5BF48304F24816AD419BB255DBB56986CF50

Function 04F60BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F64381

Memory Dump Source

Source File: 00000003.00000002.2612824498.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f60000_5tCuNr661k.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: edcccdf0b53221d9593c2b1f55132f54743d0fb67310b2b824173877ba2c0e01
Instruction ID: 9bc5c04b0f5fd6347eb1679505e928f3632882e1851fb5b8e5b965cb3514d6b1
Opcode Fuzzy Hash: edcccdf0b53221d9593c2b1f55132f54743d0fb67310b2b824173877ba2c0e01
Instruction Fuzzy Hash: FE415AB4A00305DFDB14DF9AC449AAABBF5FF88314F248558E519AB321D375A841CBA4

Function 00DB4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB59F1

Memory Dump Source

Source File: 00000003.00000002.2610631552.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_5tCuNr661k.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 683ac73a0c510ccceff100a96a18eea5b5a2473245ca46bd6528f3107598ffe9
Instruction ID: e7d9ea4f1a3725102440984ceabaa63eb07612b2f47fe0af117e26bf0387d627
Opcode Fuzzy Hash: 683ac73a0c510ccceff100a96a18eea5b5a2473245ca46bd6528f3107598ffe9
Instruction Fuzzy Hash: 0F41C1B0C00719CBDB24CFAAC884BDDBBB5BF48304F20816AD409BB255DBB56945CFA0

Function 00DBC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00DBD2C6,?,?,?,?,?), ref: 00DBD387

Memory Dump Source

Source File: 00000003.00000002.2610631552.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_5tCuNr661k.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b50d7c90f94951cf9eea568f6a8491edf36d52cfcbc16128c18c2f185245dfb4
Instruction ID: f82a10873160aaf40dabe19ac1a61511fee8ccc0a277180063756c2adf06ba89
Opcode Fuzzy Hash: b50d7c90f94951cf9eea568f6a8491edf36d52cfcbc16128c18c2f185245dfb4
Instruction Fuzzy Hash: 0E2114B5900308DFDB10CF9AD884BEEBBF5EB48310F24802AE959A3311D374A950CFA5

Function 00DBD2F9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00DBD2C6,?,?,?,?,?), ref: 00DBD387

Memory Dump Source

Source File: 00000003.00000002.2610631552.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_5tCuNr661k.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6cc9274909ac1abaa3d396598ab29a954d6a19bd49dedee199f5e06a787e00b2
Instruction ID: 1480cdbf99926d1fdd599a4fcc2d2bd4bd1ebdad0164b98fbaf55f2accc56626
Opcode Fuzzy Hash: 6cc9274909ac1abaa3d396598ab29a954d6a19bd49dedee199f5e06a787e00b2
Instruction Fuzzy Hash: BF2114B5D00209DFDB10CF9AD484AEEBBF5EB48310F14802AE958A3311D374A941CFA1

Function 00DBB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DBB086

Memory Dump Source

Source File: 00000003.00000002.2610631552.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_5tCuNr661k.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cb884891a01f8d36c815af3a3ac2783a87ac98ad601092dcfaec30c2783ea45e
Instruction ID: c5c0ad1954f094d0933c096273abc7b91e98cb8adff6c3a3321a4c313aad23d5
Opcode Fuzzy Hash: cb884891a01f8d36c815af3a3ac2783a87ac98ad601092dcfaec30c2783ea45e
Instruction Fuzzy Hash: 4911D2B5C00749CFDB10DF9AC444BDEFBF4AB49720F14842AD469A7210D3B5A545CFA5

Function 00C9D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610289876.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57cad10222b630038222c9573916ca0489261385cf1555e3be2d64d280d4ae3
Instruction ID: a2e8b18e5e9a173a7040635f84f56191c0eda5eb209bb24015a360f29c6437d9
Opcode Fuzzy Hash: d57cad10222b630038222c9573916ca0489261385cf1555e3be2d64d280d4ae3
Instruction Fuzzy Hash: 172134B2504240DFDF05DF14D9C8B26BF65FB88318F20C5A9E80A2B256C336D956CBA2

Function 00CAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610363728.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cad000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eede6a41a0a2e339f232b04a01d5e505a30ebdd3cfd846d560112733202212
Instruction ID: 28a6b28c5e204c39d71fe9fd6dfa1af817c3c18108d779c9fa72cc8fe9556e5f
Opcode Fuzzy Hash: 03eede6a41a0a2e339f232b04a01d5e505a30ebdd3cfd846d560112733202212
Instruction Fuzzy Hash: 20212271604300DFDB14DF20D9C0B26BB61EB89318F20C56DE84B4B692C336D847CA62

Function 00CAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610363728.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cad000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c1f31da349c7bc78c0fa1a4571f2439c43f52fceef1ca74a7975c085dfcbd6
Instruction ID: 63b66c200be683c28e994a680ce333186d37ec51d8b0ebed6e3a08a3f3983f52
Opcode Fuzzy Hash: e9c1f31da349c7bc78c0fa1a4571f2439c43f52fceef1ca74a7975c085dfcbd6
Instruction Fuzzy Hash: 4E2165755093C08FCB12CF24D594715BF71EB46318F28C5EAD84A8F6A7C33A994ACB62

Function 00C9D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610289876.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction ID: 7aa8f25d31fa1bade58038e36f88430d56fdc5e60a2797958af9877c7eb6ebee
Opcode Fuzzy Hash: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction Fuzzy Hash: 7A11E6B6504280CFCF15CF10D5C4B16BF71FB94318F24C6A9D84A5B656C336D95ACBA1

Function 00C9D5F3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610289876.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ff853644d847c87eb2deba326a4cb94a630325f1015a9c416fbe4a3720a973
Instruction ID: 1ef66db8608b0cd243bec4a83f82cd236a522f1a4aab2d0564339c21a0fa60f3
Opcode Fuzzy Hash: c6ff853644d847c87eb2deba326a4cb94a630325f1015a9c416fbe4a3720a973
Instruction Fuzzy Hash: 96F0F976200600AF97208F0AD884C27FBADEBD4770719C55AFC4A5B612C772EC42DEA0

Function 00C9D5E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610289876.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_5tCuNr661k.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47826dec875aa32b292cce276166373ae3c3920f0d43ea52e7c4f920722e975
Instruction ID: ae8d3484ad18c08779a5d71de752038c0f716f672ac91119e7a080272f88c232
Opcode Fuzzy Hash: a47826dec875aa32b292cce276166373ae3c3920f0d43ea52e7c4f920722e975
Instruction Fuzzy Hash: B7F03C75104A80AFD7158F06C884C22BFB9EF897607198589F89A5B262C671FC42DB60

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5tCuNr661k.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5tCuNr661k.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
5tCuNr661k.exe

Function 053C09B0 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Function 053C09C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 097FB70E Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 097FB718 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 053C5138 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Function 053C518D Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Function 053C5190 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 014C8EBC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 053C314C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 014C7A4C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 097FB488 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 097FB490 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON