Edit tour

Windows Analysis Report
w4oDGAPUMH.exe

Overview

General Information

Sample name:	w4oDGAPUMH.exe renamed because original name is a hash value
Original sample name:	08eb85ed06de39fcb6fd922c757a85a1.exe
Analysis ID:	1519288
MD5:	08eb85ed06de39fcb6fd922c757a85a1
SHA1:	c26b7a4e8f413e238c25f6e1af53ba34322f54bc
SHA256:	c3fd15f05ea03c2824e605c4492f64e958150bab079681478e1696d20fc2ecb2
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

w4oDGAPUMH.exe (PID: 4216 cmdline: "C:\Users\user\Desktop\w4oDGAPUMH.exe" MD5: 08EB85ED06DE39FCB6FD922C757A85A1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["217.119.129.17:1912"], "Bot Id": "7400515879", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
w4oDGAPUMH.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1433226533.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: w4oDGAPUMH.exe PID: 4216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: w4oDGAPUMH.exe PID: 4216	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.w4oDGAPUMH.exe.a50000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:59:39.363130+0200	2043234	1	A Network Trojan was detected	217.119.129.17	1912	192.168.2.8	49704	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:59:39.172014+0200	2043231	1	A Network Trojan was detected	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:44.723363+0200	2043231	1	A Network Trojan was detected	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:51.389488+0200	2043231	1	A Network Trojan was detected	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:51.671179+0200	2043231	1	A Network Trojan was detected	192.168.2.8	49704	217.119.129.17	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:59:50.360450+0200	2046056	1	A Network Trojan was detected	217.119.129.17	1912	192.168.2.8	49704	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:59:39.172014+0200	2046045	1	A Network Trojan was detected	192.168.2.8	49704	217.119.129.17	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: w4oDGAPUMH.exe

Avira: detected

Found malware configuration

Source: w4oDGAPUMH.exe

Malware Configuration Extractor: RedLine {"C2 url": ["217.119.129.17:1912"], "Bot Id": "7400515879", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: w4oDGAPUMH.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: w4oDGAPUMH.exe

Joe Sandbox ML: detected

Source: w4oDGAPUMH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: w4oDGAPUMH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then jmp 063BB397h	0_2_063BAC38
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then jmp 063BB962h	0_2_063BB540
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then jmp 063BBDE2h	0_2_063BB540
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then jmp 063BC2C3h	0_2_063BC000
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then jmp 063B9523h	0_2_063B950B
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then jmp 063BF3BDh	0_2_063BF39C
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	0_2_063B2190

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.8:49704 -> 217.119.129.17:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.8:49704 -> 217.119.129.17:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 217.119.129.17:1912 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 217.119.129.17:1912 -> 192.168.2.8:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 217.119.129.17:1912

Source: global traffic

TCP traffic: 192.168.2.8:49704 -> 217.119.129.17:1912

Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17
Source: unknown	TCP traffic detected without corresponding DNS query: 217.119.129.17

Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: w4oDGAPUMH.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_0121DC74	0_2_0121DC74
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BE6E0	0_2_063BE6E0
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BAC38	0_2_063BAC38
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BF450	0_2_063BF450
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BB540	0_2_063BB540
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BA268	0_2_063BA268
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BC000	0_2_063BC000
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BD0D3	0_2_063BD0D3
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BD930	0_2_063BD930
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BE1A0	0_2_063BE1A0
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B7E78	0_2_063B7E78
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B8C20	0_2_063B8C20
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BF440	0_2_063BF440
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B84B8	0_2_063B84B8
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B84A7	0_2_063B84A7
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B54C8	0_2_063B54C8
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063BB52F	0_2_063BB52F
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B5D98	0_2_063B5D98
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B7A10	0_2_063B7A10
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B03B0	0_2_063B03B0
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B03A9	0_2_063B03A9
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B9BE8	0_2_063B9BE8
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Code function: 0_2_063B5180	0_2_063B5180

Source: w4oDGAPUMH.exe, 00000000.00000000.1433269843.0000000000A82000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs w4oDGAPUMH.exe
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs w4oDGAPUMH.exe
Source: w4oDGAPUMH.exe, 00000000.00000002.1578793320.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs w4oDGAPUMH.exe
Source: w4oDGAPUMH.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs w4oDGAPUMH.exe

Source: w4oDGAPUMH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Mutant created: NULL

Source: w4oDGAPUMH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: w4oDGAPUMH.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: w4oDGAPUMH.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: w4oDGAPUMH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: w4oDGAPUMH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: w4oDGAPUMH.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Code function: 0_2_06A34B11 pushfd ; retf

0_2_06A34B12

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Memory allocated: 11F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Memory allocated: 4D50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Window / User API: threadDelayed 911			Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Window / User API: threadDelayed 2115			Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe TID: 4132	Thread sleep time: -11068046444225724s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe TID: 4124	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1578793320.000000000113B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.000000000322C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690LR
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: w4oDGAPUMH.exe, 00000000.00000002.1581799390.00000000040DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: w4oDGAPUMH.exe, 00000000.00000002.1579392448.00000000032DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Users\user\Desktop\w4oDGAPUMH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: w4oDGAPUMH.exe, type: SAMPLE
Source: Yara match	File source: 0.0.w4oDGAPUMH.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1433226533.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w4oDGAPUMH.exe PID: 4216, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\w4oDGAPUMH.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w4oDGAPUMH.exe PID: 4216, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: w4oDGAPUMH.exe, type: SAMPLE
Source: Yara match	File source: 0.0.w4oDGAPUMH.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1433226533.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w4oDGAPUMH.exe PID: 4216, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
w4oDGAPUMH.exe	82%	ReversingLabs	Win32.Trojan.RedlineStealer
w4oDGAPUMH.exe	100%	Avira	TR/AD.RedLineSteal.vnqrx
w4oDGAPUMH.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
217.119.129.17:1912	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/D	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/06/addressingex	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
217.119.129.17:1912	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	w4oDGAPUMH.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/D	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	w4oDGAPUMH.exe, 00000000.00000002.1579392448.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
217.119.129.17	unknown	unknown		16298	INTERBOX-ASLubbersBoxTelematicaBVNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519288
Start date and time:	2024-09-26 09:58:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	w4oDGAPUMH.exe renamed because original name is a hash value
Original Sample Name:	08eb85ed06de39fcb6fd922c757a85a1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 72 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: w4oDGAPUMH.exe

Simulations

Behavior and APIs

Time	Type	Description
03:59:48	API Interceptor	18x Sleep call for process: w4oDGAPUMH.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERBOX-ASLubbersBoxTelematicaBVNL	malw-20210521-bkp.elf	Get hash	malicious	Xmrig	Browse	217.119.67.6
	Win32.Wannacry.dll	Get hash	malicious	Wannacry	Browse	217.119.142.207
	sora.arm	Get hash	malicious	Mirai	Browse	217.119.67.5

Process:	C:\Users\user\Desktop\w4oDGAPUMH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.1618900403311665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	w4oDGAPUMH.exe
File size:	192'000 bytes
MD5:	08eb85ed06de39fcb6fd922c757a85a1
SHA1:	c26b7a4e8f413e238c25f6e1af53ba34322f54bc
SHA256:	c3fd15f05ea03c2824e605c4492f64e958150bab079681478e1696d20fc2ecb2
SHA512:	fa0717518781a1c673ba647112930aa2c7116b9b8cdd0ee88c74b44ed4178326eafa4d079fafb51c560a5d3ef2ced55fb86002e10da2e4b5948684aaee09a573
SSDEEP:	3072:zcZqf7D342p/0+mAaky4o0QogZzB1fA0PuTVAtkxz+3Rx:zcZqf7DIOnov1B1fA0GTV8kk
TLSH:	AC146B5833E8C614EA7F4B79D471164497B0F163F917EB1B4FC894AA2D23700EA21AB7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. .......................`.......z....@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4302fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x302a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x5de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e304	0x2e400	f9d486ce9ff11f476b40fbeffb22ca7c	False	0.4751266891891892	data	6.188253530767491	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x5de	0x600	2cde5f2d825dd9344e0825551b3220bc	False	0.44140625	data	4.21397277350532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34000	0xc	0x200	55f9eb3ef5d1fad739850bd7f59c3f20	False	0.041015625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x320a0	0x352	data			0.4447058823529412
RT_MANIFEST	0x323f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T09:59:39.172014+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:39.172014+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:39.363130+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	217.119.129.17	1912	192.168.2.8	49704	TCP
2024-09-26T09:59:44.723363+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:50.360450+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	217.119.129.17	1912	192.168.2.8	49704	TCP
2024-09-26T09:59:51.389488+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.8	49704	217.119.129.17	1912	TCP
2024-09-26T09:59:51.671179+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.8	49704	217.119.129.17	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:59:38.290018082 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:38.295042038 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:38.295130014 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:38.303606033 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:38.308429003 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:38.935015917 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:38.982692957 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:39.172013998 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:39.176891088 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:39.363130093 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:39.420077085 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:44.723362923 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:44.732914925 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922113895 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922136068 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922152996 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922174931 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922192097 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922199011 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:44.922210932 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:44.922241926 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:44.922255993 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.355323076 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.360450029 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360559940 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360570908 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360578060 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.360629082 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.360662937 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360672951 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360716105 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360727072 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360728025 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.360775948 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.360784054 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360797882 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360822916 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.360840082 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.360861063 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.365549088 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.365624905 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.365627050 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.365636110 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.365660906 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.365675926 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.365704060 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.365735054 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.365745068 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.365780115 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.366530895 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.366612911 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.370554924 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.370608091 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.371181011 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.371264935 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.372189999 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.372277021 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.372330904 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.375864029 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.375922918 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.375932932 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.375933886 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.375952959 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.375962973 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.375972986 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.375981092 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376007080 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376023054 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376665115 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376684904 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376715899 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376715899 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376734972 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376735926 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376746893 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376759052 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376774073 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376789093 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376820087 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376828909 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376837969 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376846075 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376872063 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376893997 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376924038 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376935005 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376943111 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.376976013 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376996040 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.376996040 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377023935 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377026081 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377031088 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377036095 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377055883 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.377136946 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377155066 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.377182961 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377192020 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377358913 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377368927 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377377033 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377386093 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377399921 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377408028 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377444029 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377453089 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377484083 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377491951 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377504110 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377530098 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377537966 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377680063 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377695084 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377700090 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377706051 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377711058 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377715111 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377720118 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377721071 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377722025 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377774954 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377784967 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377794027 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377803087 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377810955 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.377898932 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.377974033 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.380801916 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380834103 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380851984 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380861998 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380871058 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380881071 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380888939 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.380994081 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381021976 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381045103 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381061077 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381071091 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381581068 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381591082 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381623030 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381688118 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381784916 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381797075 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381896019 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381906033 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.381998062 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382008076 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382294893 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382304907 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382313967 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382323027 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382330894 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382339954 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382375956 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382388115 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382400990 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382411957 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382482052 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382491112 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382523060 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382530928 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382647038 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382667065 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382853031 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.382920980 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383044004 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383152008 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383162022 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383300066 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383344889 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383353949 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383444071 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383452892 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383486032 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.383487940 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383497000 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383519888 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383570910 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.383611917 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383621931 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383630037 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383666992 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383676052 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383745909 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383754015 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383804083 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383811951 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383846998 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383857012 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383929014 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383938074 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.383996010 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384005070 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384033918 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384042025 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384097099 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384107113 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384202003 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384236097 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384284019 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384293079 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384366035 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384375095 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384418011 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384427071 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384469986 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384480000 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384568930 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384577990 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384619951 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384629011 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384669065 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384677887 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384737015 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384744883 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384793043 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384802103 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384848118 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384856939 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384901047 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384910107 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384947062 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384955883 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.384970903 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388598919 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388622046 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388642073 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388652086 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388669014 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388679028 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388688087 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388715029 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388731956 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388741016 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388750076 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388758898 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388767004 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388786077 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388797045 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388813019 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388823986 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388851881 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388868093 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388878107 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388885975 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388911963 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388926983 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388936996 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388947010 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388978958 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.388997078 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389022112 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389031887 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389041901 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389050961 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389154911 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389163971 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389173985 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389183998 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389210939 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389219999 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389242887 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389251947 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389257908 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.389276981 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389286041 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389309883 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389319897 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389353991 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.389374018 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389390945 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389410019 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389425993 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389435053 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389444113 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389467001 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389477015 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389487028 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.389497042 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394371033 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394383907 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394401073 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394486904 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394496918 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394547939 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394579887 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.394681931 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.394691944 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394704103 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394718885 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394726992 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394754887 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394784927 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394885063 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394910097 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.394965887 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395018101 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395026922 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395036936 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395046949 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395163059 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395181894 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395196915 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395205975 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395215034 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395230055 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395239115 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395247936 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395256042 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395279884 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395292044 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395313025 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395328045 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395339012 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395353079 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395368099 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.395376921 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.443458080 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.443682909 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.443809032 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.443809032 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.443891048 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.449583054 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.449620008 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.449708939 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.449717999 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.449727058 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.449738026 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.449817896 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.449940920 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.486022949 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.486249924 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:50.491158009 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491213083 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491218090 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491302013 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491322041 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491331100 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491336107 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491352081 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491363049 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491372108 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491430044 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491439104 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491447926 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491456985 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491523027 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491544962 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491561890 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491570950 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491588116 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491599083 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491611004 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491625071 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491642952 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491657019 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491672993 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491682053 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491759062 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491767883 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491794109 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491802931 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491861105 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491871119 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491910934 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491920948 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491955042 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.491976976 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492029905 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492039919 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492069960 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492126942 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492136955 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492157936 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492173910 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492182970 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492191076 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492207050 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492223024 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492239952 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492255926 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492264986 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492337942 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:50.492352962 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:51.378463984 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:51.389487982 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:51.394560099 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:51.580523014 CEST	1912	49704	217.119.129.17	192.168.2.8
Sep 26, 2024 09:59:51.638789892 CEST	49704	1912	192.168.2.8	217.119.129.17
Sep 26, 2024 09:59:51.671179056 CEST	49704	1912	192.168.2.8	217.119.129.17

Target ID:	0
Start time:	03:59:36
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\w4oDGAPUMH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\w4oDGAPUMH.exe"
Imagebase:	0xa50000
File size:	192'000 bytes
MD5 hash:	08EB85ED06DE39FCB6FD922C757A85A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1433226533.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1579392448.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	8

Executed Functions

Function 063BE6E0 Relevance: 2.0, Strings: 1, Instructions: 759
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@B/, xrefs: 063BEA07

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID: @B/
API String ID: 0-3863299084
Opcode ID: 945b30e995067af03959a7a158f3003fba0392d71bb27c9e0ab2765ca3715c7f
Instruction ID: 22c6f463494f9820f7b4debed5c6132f7aae35101af461c5aae8edf97aa3fe82
Opcode Fuzzy Hash: 945b30e995067af03959a7a158f3003fba0392d71bb27c9e0ab2765ca3715c7f
Instruction Fuzzy Hash: CF829E74E012298FDBA8CF69C984BDDBBB1BF49301F1091E9D509A7650DB319E85CF90

Function 063BF450 Relevance: 1.6, Strings: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l85t, xrefs: 063BF761

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID: l85t
API String ID: 0-2408928284
Opcode ID: 1d11e89c95fac721191f454d1001cdb99f248d92a2a5307be69c15a5575fea40
Instruction ID: 31bd43a1e9993bd0f776076d4669b9f4e6fa4dba320e5c182a50b825f3e29f6d
Opcode Fuzzy Hash: 1d11e89c95fac721191f454d1001cdb99f248d92a2a5307be69c15a5575fea40
Instruction Fuzzy Hash: E3E1E274E01229CFEB68CF65C944BDEBBB2BF89300F50A1AAC549B7254DB305A85CF50

Function 063BB540 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b4f208f100b34c9e3b168bf73dd1a1da380a576209c62654bee2d70d0260e7
Instruction ID: 8c83f17ef0d8630fbe22a4c81fd6b5e946197703a84dc0eaab2ae4e052139acb
Opcode Fuzzy Hash: 37b4f208f100b34c9e3b168bf73dd1a1da380a576209c62654bee2d70d0260e7
Instruction Fuzzy Hash: 59329270A01228CFDB68DF64C994BDDB7B2BF89300F5091E9D50AAB250DB359E85CF90

Function 063BAC38 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fd9d52b7da2cb86c65b1d974cf781ab7cc9b695316c4c3cb02770906b1ba2a
Instruction ID: f9d548c27dd17de7271e9036be04e48b646229f2f03310452ee42c0af2ea98be
Opcode Fuzzy Hash: 92fd9d52b7da2cb86c65b1d974cf781ab7cc9b695316c4c3cb02770906b1ba2a
Instruction Fuzzy Hash: 94229D74E00229CFDB64DF64C994BD9B7B2BF89300F1091EAD549AB650EB319E85CF90

Function 063BD930 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bdaab8a29796f0a23f216f9b7d6a693165721cbe86992140130881e8998046
Instruction ID: d230afa288d1f67b3ba9f950632214a7881d49739aef122cb6d20fcd84853c27
Opcode Fuzzy Hash: 90bdaab8a29796f0a23f216f9b7d6a693165721cbe86992140130881e8998046
Instruction Fuzzy Hash: E0225974E012288FDB64DF68C994BDDBBB2BB89300F5091EAD549AB350DB315E85CF50

Function 063BA268 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65a69a9dc19e5f0233b49806e3fcb4a809588cff07929c326beaea4af8e7046
Instruction ID: 9582527ceee0ed29e0a851ed441b1af94b2b6bd98a4bddf76e84939d0999e71f
Opcode Fuzzy Hash: d65a69a9dc19e5f0233b49806e3fcb4a809588cff07929c326beaea4af8e7046
Instruction Fuzzy Hash: B702BE74A01228CFDBA8DF64C894BDEB7B2BF89300F5095E9D509AB254DB319E85CF50

Function 063BD0D3 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c31b31484f4108083ccf117ed6556f5181380c7d2865135ffeae9d7fd36893
Instruction ID: 35ac4de53e73c5403d7db491f5f1f532359e7a202208845c3e0b6afff2f846c3
Opcode Fuzzy Hash: 35c31b31484f4108083ccf117ed6556f5181380c7d2865135ffeae9d7fd36893
Instruction Fuzzy Hash: 99B1C374E01228CFDB68DF65C894B9DBBB2BF89300F1095AAD409AB350DB315E85CF50

Function 063BC000 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d2ea42d7514495bc5c6cb3ddee66847d6cf3a8c422fb4d16fee2ad5b492424
Instruction ID: 46d1a64f29bbd3b08d47bcc068e4ef44262ce7128701c6a9ec3a9482d2e6471c
Opcode Fuzzy Hash: b2d2ea42d7514495bc5c6cb3ddee66847d6cf3a8c422fb4d16fee2ad5b492424
Instruction Fuzzy Hash: A9A10674E00228CFDB68DFA5C854BDEBBB2BF89300F10A1A9D549AB354DB315985CF91

Function 063BE1A0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92a841a707bb62562d80ef6c2e5bb52b92ccf8af64fa7a53677ec6ab0be5a77
Instruction ID: e9b45fe7163d4ef32ceedc3ab0fd2ed6b26d32897a71288451008c82e1d26317
Opcode Fuzzy Hash: e92a841a707bb62562d80ef6c2e5bb52b92ccf8af64fa7a53677ec6ab0be5a77
Instruction Fuzzy Hash: 9991E174E01218CFDB58DFA9D884ADDBBB2FF89301F209169E409AB354DB359986CF40

Function 0121AE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 60376ed6fb59bbe46c8d0ccd86fe4da792e2898f654faa04d46969670b16fb0a
Instruction ID: 75b18b1fdfd4a841651ba4313a394325ac472d4a9e602a7d154ecb1959a9247e
Opcode Fuzzy Hash: 60376ed6fb59bbe46c8d0ccd86fe4da792e2898f654faa04d46969670b16fb0a
Instruction Fuzzy Hash: 277179B0A11B468FEB24DF29D44479ABBF1FF98300F00892DE58AC7A54D775E845CB90

Function 01214248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012159F1

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 45b61f4ed8757c8985562594836084fce15345e5f7e673defeef0c2d974c51ea
Instruction ID: 9f61a9a04e581d9df33275471689b23c6f576d00024b25192c9fca5973c07ba3
Opcode Fuzzy Hash: 45b61f4ed8757c8985562594836084fce15345e5f7e673defeef0c2d974c51ea
Instruction Fuzzy Hash: 6241B071D10719CBEB24CFA9C884BDEBBF5BF89304F20806AD408AB255DBB56945CF91

Function 01215935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012159F1

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 84b3e73c339efeef2e3b13820c6b85ef5f0aae4b91c8ad594655e884ed012263
Instruction ID: a2b87247debacb4f6c8234c79f05a31b7edc71203b391518e40ec321654319bc
Opcode Fuzzy Hash: 84b3e73c339efeef2e3b13820c6b85ef5f0aae4b91c8ad594655e884ed012263
Instruction Fuzzy Hash: 3D41CFB1D10719CBEB24CFA9C8847CEBBF5BF89304F24806AD408AB255DBB56945CF91

Function 0121C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0121D2C6,?,?,?,?,?), ref: 0121D387

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b7726e0b588f332f7a36474f84509c630c93766234a3caa006be3d68aea25031
Instruction ID: 43fbea7c3e8c400420f8b84e13e5c57c6d5df7c9d9795d83d43da090ee4306bc
Opcode Fuzzy Hash: b7726e0b588f332f7a36474f84509c630c93766234a3caa006be3d68aea25031
Instruction Fuzzy Hash: 8021E3B591020CDFDB10CFAAD984ADEBBF8EB48310F14841AE918A3350D378A954CFA5

Function 0121D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0121D2C6,?,?,?,?,?), ref: 0121D387

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7c218542ec1d0aeab95e848d769d01e5b61bb9f00db0b8a53e3545822e448a56
Instruction ID: 8beca3e45ae7913b6dcfac11da344c16561211e89d4e4ac99f76833a7110c4a3
Opcode Fuzzy Hash: 7c218542ec1d0aeab95e848d769d01e5b61bb9f00db0b8a53e3545822e448a56
Instruction Fuzzy Hash: 9B21E2B5900209DFDB10CFAAD984ADEBBF5FB48314F14801AE918A3350D378A954CF65

Function 01219838 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0121AE4C), ref: 0121B086

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4a68c4e65229aa33e038a06aca37230fcd4249090b1f2b12b0ee884205f0db98
Instruction ID: 50a6bd9d3cf63c3f15065e565898bda31b1d63bf3fdc2fac220f628285eeeb9a
Opcode Fuzzy Hash: 4a68c4e65229aa33e038a06aca37230fcd4249090b1f2b12b0ee884205f0db98
Instruction Fuzzy Hash: 5B1120B1C003098BDB20CF9AC444BDEFBF4EF48210F10842AD529A7210D3B9A509CFA1

Function 06A31B08 Relevance: 1.5, Instructions: 1467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826f251ceed1ebdc305c9e297fd58995dd0bb1b557f680c52df50b4d06cb82d6
Instruction ID: ea5fe1cb4af732a21c4dba577d054e0de05b2a0b24915c8f8ad72a4f4b022982
Opcode Fuzzy Hash: 826f251ceed1ebdc305c9e297fd58995dd0bb1b557f680c52df50b4d06cb82d6
Instruction Fuzzy Hash: 6FC22D70A002189FDB58DF64C891FEDBBB6EF89700F50809AE605AB3A1DB719D85CF51

Function 063BC8E0 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[e, xrefs: 063BC978, 063BC97D

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID: [e
API String ID: 0-2158396884
Opcode ID: 2a03d3c65c0be69ebdc5f49db169bb5116e79c8e4d8f5498eec2b31a259e84f8
Instruction ID: c3e8cd00322e84d3a333d15b053338b63f0ae572d69121c786b569ab27629b70
Opcode Fuzzy Hash: 2a03d3c65c0be69ebdc5f49db169bb5116e79c8e4d8f5498eec2b31a259e84f8
Instruction Fuzzy Hash: BB31E4B8E01219EFDF94DFA8E585ADDB7F1AB88300F206529E405F7704DB346945CB91

Function 063BC8F0 Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[e, xrefs: 063BC978, 063BC97D

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID: [e
API String ID: 0-2158396884
Opcode ID: 0248e7ca0468ca2d4892b9591ad1bdbbc064d358e693d2ea1cebf6a4af285fe4
Instruction ID: 7dd2a0e059da25432825e8819348793e8e29e482383f0992d6e4aeed7d49d5bd
Opcode Fuzzy Hash: 0248e7ca0468ca2d4892b9591ad1bdbbc064d358e693d2ea1cebf6a4af285fe4
Instruction Fuzzy Hash: 9131C074E01209AFDF94DFA9E985ADDBBF1FB88300F106129E405B7304EB356A45CBA1

Function 06A30048 Relevance: .7, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12eafd2440abcae94224450d64ada31a963b4c1f1156538b49417942d17a461e
Instruction ID: cc6fa62d877e5b7ac6fa1b3437398e67c1b13d547bacea1f8f0c3cb66b266fe4
Opcode Fuzzy Hash: 12eafd2440abcae94224450d64ada31a963b4c1f1156538b49417942d17a461e
Instruction Fuzzy Hash: 31428A307107219FEB68AF64D89066EB7F2BFC5B10B500A5CE5039B390DB76EC458B91

Function 06A33980 Relevance: .7, Instructions: 660
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1817c17b52bba9cc9aa91a0f07a2975d9617aad646de15dd5b110889c6434364
Instruction ID: 3dc377dd0030e6dbc314919658aaa0ac34cc67f041ec96bce3fec06bc75ee677
Opcode Fuzzy Hash: 1817c17b52bba9cc9aa91a0f07a2975d9617aad646de15dd5b110889c6434364
Instruction Fuzzy Hash: 4D420475B002188FDB54DF68C994EADBBF6EF89700F148099E506EB3A1DA71ED44CB50

Function 06A30CF0 Relevance: .6, Instructions: 608
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56797248aeabd6e288d9c6febde00433df84c7fdf993b9871e886816c36deab
Instruction ID: c8d48d87a3dd62e6f5a86e3cbb4d64ef4e1a849f3176be4509dce71370e7608e
Opcode Fuzzy Hash: d56797248aeabd6e288d9c6febde00433df84c7fdf993b9871e886816c36deab
Instruction Fuzzy Hash: C522BF30B002159FDB59AB69C954A7EBBF6FF89200F14846AE916CB3A2DF30DC41DB51

Function 06A32000 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6bab64b05ede9386c82f0dad6daea888466297009f1291b6d73594e6bb9815
Instruction ID: 5843180a747816fdf59586df2d2daafcda1fd91e1fd9b0bdf1eafbe5eb2b7724
Opcode Fuzzy Hash: 2e6bab64b05ede9386c82f0dad6daea888466297009f1291b6d73594e6bb9815
Instruction Fuzzy Hash: 5E329774B042248FDB19AB64D996FADB7B2EF89704F10808AFA065B391CB71DD81CF51

Function 06A31AEC Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dbb086b134bbf78c0643b0302f8423acd2b36d23d893ab81f038db88a922c7
Instruction ID: d26d187af825d8a62c37bf7100187eb920b3070efa082336b4010159385d9bdb
Opcode Fuzzy Hash: e4dbb086b134bbf78c0643b0302f8423acd2b36d23d893ab81f038db88a922c7
Instruction Fuzzy Hash: DAD13770B20114AFC744EF98C894E9AB7B6FF49704BA08059FA06DB761CBB1ED45CB61

Function 06A30000 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960431ecf1b391e4f05b02f3bb9e8bf5af62986bdd3a31c49a17a0fb929a8b19
Instruction ID: 148bf00ec5a1f62e2b433f0486161b481b0c7daad9faa456388d566b89dae31f
Opcode Fuzzy Hash: 960431ecf1b391e4f05b02f3bb9e8bf5af62986bdd3a31c49a17a0fb929a8b19
Instruction Fuzzy Hash: C5D1A330B10314DFDB45AF64C954B79BBB6AF8A700F54405AE602DB3A2DBB5DC44CBA1

Function 06A314EA Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453b37f8aab67baf23cc60c35aa14402b935b4b5564d29719b9e4c19d630c7a8
Instruction ID: cdad920041860c36ff3657e5f886422a9461dee7861d08fa198fd0bf5cef5115
Opcode Fuzzy Hash: 453b37f8aab67baf23cc60c35aa14402b935b4b5564d29719b9e4c19d630c7a8
Instruction Fuzzy Hash: 47C1E230B003109FEB54AB68C994B6EB7F6EF85704F14946AE9038B392DF75DC428B91

Function 06A305D6 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a49eeada433533a4d2162649a6fe90ae93d7b330cf1b4b8102b0813043a8d02
Instruction ID: 4ffda4257ad6e708e15994a9027e6b05c6837f8e0c0798ee16baff419c7e2806
Opcode Fuzzy Hash: 8a49eeada433533a4d2162649a6fe90ae93d7b330cf1b4b8102b0813043a8d02
Instruction Fuzzy Hash: 02B1A030B10214DFEB44AF64C998B7AB7B6AF89704F545059F6029B3A1DBB2DC44CBA1

Function 06A3064E Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6855fdbef10d79e99931844864ae352d35de6d32c5396d16222bd7c87a62b6
Instruction ID: cac8045b63e8dd798e25fd2ea31d5cc4731eba77fec334f5ef4b73ff25719137
Opcode Fuzzy Hash: 2a6855fdbef10d79e99931844864ae352d35de6d32c5396d16222bd7c87a62b6
Instruction Fuzzy Hash: A9B1A130B10214DFEB44AF64C998B79B7B6EF89704F545059F6029B3A1DBB2DC44CBA1

Function 06A306C6 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefd941acf79c7295805c2aaad6443fe3018342dc875e76c8c06e7e40ab75ebe
Instruction ID: c33ce8118c0f5d63973662b171d44d03f06dd2c454c27cab189a5cf9e517e1a6
Opcode Fuzzy Hash: fefd941acf79c7295805c2aaad6443fe3018342dc875e76c8c06e7e40ab75ebe
Instruction Fuzzy Hash: EFB1A130B50214DFEB44AF64C998B79B7B6EF89704F544059FA029B3A1DBB2DC44CBA1

Function 06A3055E Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a816f0317c6e33761236e46e6352ec193a7679dd0c737d43688ec363f3fb903
Instruction ID: 6a3592c7130bc2dc6a4821f354ae50849b543aa5542abcb3273d4d9cf99f78c9
Opcode Fuzzy Hash: 1a816f0317c6e33761236e46e6352ec193a7679dd0c737d43688ec363f3fb903
Instruction Fuzzy Hash: 40B1A030B10214DFEB44AF64C998B7AB7B6AF89704F544059F6029F3A1DBB2DC44CBA1

Function 06A345A0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5418393461cf75cc2a68526f1b8bd9134b5fffa88e12d4952b446c1bdc34284
Instruction ID: 7529ae16374abc3712cacad7aced5f81a101b3b4ef8394dec4da0a540692ea09
Opcode Fuzzy Hash: d5418393461cf75cc2a68526f1b8bd9134b5fffa88e12d4952b446c1bdc34284
Instruction Fuzzy Hash: 047182757001049FCB44DF58C998E9EB7F6FF8A700B218199F606AB361CA71EC42CB61

Function 063BA8BF Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3effbf8e1325d73132c45321ab5db7b44cecd0aa89007f7cc70b2051b2788da4
Instruction ID: 0a648ebe16d570d5dc0cfc91431fbf05a128b9207506030fa3dd4598ddb9739b
Opcode Fuzzy Hash: 3effbf8e1325d73132c45321ab5db7b44cecd0aa89007f7cc70b2051b2788da4
Instruction Fuzzy Hash: 83916D74A01228CFDBA4DF64C994BDEB7B2AB4A301F6095E9C509AB351DB319E85CF40

Function 06A34583 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e09d253e16e04e423c6f6f0a1dee581716b974e7354077b43b11197bba1d411
Instruction ID: d1e214e1477e526ae97949306e876838cbac8a450894e26b4784c2f49355a3b6
Opcode Fuzzy Hash: 3e09d253e16e04e423c6f6f0a1dee581716b974e7354077b43b11197bba1d411
Instruction Fuzzy Hash: A3713275B001149FCB44DF58C998E9DB7F6EF8A700B218199F606AB365CB71EC42CB61

Function 06A337D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa21fa02b4f87ed4a3d47599a8a7e4576a44d0aad5f80e895626de3a3de0f53e
Instruction ID: 8558a58be5e0600726ceeff20e14d882d0b2649cc9fd49c7f4b29b01bad33c2b
Opcode Fuzzy Hash: aa21fa02b4f87ed4a3d47599a8a7e4576a44d0aad5f80e895626de3a3de0f53e
Instruction Fuzzy Hash: 0D514635B102189FDB14DF69C884AAEBBB2FF88710B158069F905EB361DB31EC45CB50

Function 063BA258 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235360f28e47c58978b2591f308f4716b987e7ecd61f5a93f0f79c5f314a93f2
Instruction ID: 91b6e7e91a5cca078f526415d9512c6b7cd634bd95c9d386f998f43bb22225bf
Opcode Fuzzy Hash: 235360f28e47c58978b2591f308f4716b987e7ecd61f5a93f0f79c5f314a93f2
Instruction Fuzzy Hash: EB518835900328CBEB25DF64DC10BDEBBB2FB89300F5085A9D80A67794EB315A85CF95

Function 06A311F8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bfe4c64441dd203c9c2c1313331901de6567a66991ac24683e69bcd023ce025
Instruction ID: 625c9d56d54e7f8e4c4b34464a6a5c15756a5c499fe574857e857d89d0dcf4d9
Opcode Fuzzy Hash: 2bfe4c64441dd203c9c2c1313331901de6567a66991ac24683e69bcd023ce025
Instruction Fuzzy Hash: 184116307003109FEB54A7A9D994B7AB6B7EBC9704F204069F6128B3A1DFB1DC029B51

Function 063BFA79 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507f7116f8758b5c67a854bfe5b1dd58a1b77ea4823aecab7c4e13432caf41f9
Instruction ID: dfd8ec6e9b7a7fb6e35815e507b0b9cc8d1467ccf2e916dd9c9f87724377eb39
Opcode Fuzzy Hash: 507f7116f8758b5c67a854bfe5b1dd58a1b77ea4823aecab7c4e13432caf41f9
Instruction Fuzzy Hash: 44410674E052189FDB48DFA9D894AEEBBF2FF89300F10A029E901B7350DB305945CB90

Function 063BD920 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2321ef3b9559bafcb79b9e863e2cf494446149144cc66ed9ca59f4dd387024
Instruction ID: 0fc2d893f10143220f9b5b0ddebeec09333a599c79329938d663f8d1d7103bc4
Opcode Fuzzy Hash: 7d2321ef3b9559bafcb79b9e863e2cf494446149144cc66ed9ca59f4dd387024
Instruction Fuzzy Hash: 5951C074E01228CFEB68DF25C950B9ABBB2BF89300F5091EAC549AB250DB315E85CF51

Function 06A34440 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d810e83b7889c95b45aa61b85774bc853f4b93daeb82a72ff3096c5cf23af1
Instruction ID: e5e7d7c8036ca429999659696cecd280d4edc5038de3fc23c8f3e44e39dd177c
Opcode Fuzzy Hash: b6d810e83b7889c95b45aa61b85774bc853f4b93daeb82a72ff3096c5cf23af1
Instruction Fuzzy Hash: 32411435B402148FCB44DF69D998AAEBBF6FF88714B158069E506DB361DB31EC00CB60

Function 063BAC28 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07a072cd0e6da2ab11078cd151b37c501fb9174affcb35e1048d312a528285b
Instruction ID: e4b38dc75ae642c5ca59452b0a82b4847d56cb90d88f26297df1421e2e7387bb
Opcode Fuzzy Hash: f07a072cd0e6da2ab11078cd151b37c501fb9174affcb35e1048d312a528285b
Instruction Fuzzy Hash: 24413970E4022ACFDB68DF25C951BEDB7B2AF89300F1090E9C159A7650EB714E85CF81

Function 063BE190 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce94b9b525694b5e89a3e525b2984e9164b692c226fdbe1e9e1be5c29fdd2a33
Instruction ID: 59b2455dc8965f6c7af88129383b814215f31b9b53d579c50ba44305b3f6c087
Opcode Fuzzy Hash: ce94b9b525694b5e89a3e525b2984e9164b692c226fdbe1e9e1be5c29fdd2a33
Instruction Fuzzy Hash: 74411675E01218CFDB58DFAAD980AEDBBF2BF88340F14912AD504AB354D7345946CF50

Function 063BFC88 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e7c7be80aba579f19079c62747bc5c5d482f24750fa743fc5ba31595a26e91
Instruction ID: 42ea13f7281b72e6f36071f4068a3b705634af1c78199114a99c7412dfde3cf9
Opcode Fuzzy Hash: 68e7c7be80aba579f19079c62747bc5c5d482f24750fa743fc5ba31595a26e91
Instruction Fuzzy Hash: D331F370D01219DFCB58DFB4E854AEEBBB1EF89301F10952AD911A3790DB359945CFA0

Function 063BFC98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9f9798f5c0d719739522e0f127fa5856ab684c06cac56431e3d67547e210c5
Instruction ID: fdb06c13d4c336e2b318a50517500e06dcc23ecf0c5bdf7c784ba5916521c972
Opcode Fuzzy Hash: ca9f9798f5c0d719739522e0f127fa5856ab684c06cac56431e3d67547e210c5
Instruction Fuzzy Hash: 7631C0B0D01219DFCB58DFA4E454AEEBBB2FF89301F10952AE915A3390DB359941CFA4

Function 063BFF08 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1209b6a91e10ea073247b6b30f2bc65ee748dd4a5597c15e0dfffcdf804dfb1
Instruction ID: d1812ce00b7f4d10309c980ca95879ae589bf9ba01545d6929610f010204f717
Opcode Fuzzy Hash: f1209b6a91e10ea073247b6b30f2bc65ee748dd4a5597c15e0dfffcdf804dfb1
Instruction Fuzzy Hash: 191193716102058BCB14EB78C5599AEB7F6EFC4211B008969D606DB790EF74EC058B91

Function 06A30FC4 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586331508.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a30000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082270e93977a7d7a8b094f845effb1756155df106cfefa74a1ba8151f620ea1
Instruction ID: 4bee64e2abf20bd077886085190eb9fdb30af6f5732cc0f4e5a75527ae907dee
Opcode Fuzzy Hash: 082270e93977a7d7a8b094f845effb1756155df106cfefa74a1ba8151f620ea1
Instruction Fuzzy Hash: E921F530B04294DFDB54EB69D95486EBBF6EFC5210B1645BAE415CB7A2EB30CC10C791

Function 0104D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1578512875.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f7b55289bd7952bddd9d6a50033cbbfd49b5ee25a37bac45324696bcc0148f
Instruction ID: 8944c0bdd4ede9da4d2ce6050920aded4ad23efb37df0f55b0b54f8468df37e5
Opcode Fuzzy Hash: b1f7b55289bd7952bddd9d6a50033cbbfd49b5ee25a37bac45324696bcc0148f
Instruction Fuzzy Hash: 2C2106B1504204DFDB05DF54D9C0B5ABBA5FBD4324F20C1B9E9490B256C736E456CBA2

Function 0105D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1578558473.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfafcd6005c2c5ad4afabac6505ec1e77ba8af6c43e0e3a10c4edfb0307df8ed
Instruction ID: 3611b2cc1c91fd7e283030f18660682c16957ecbe7badaf43a69da6a106c46fc
Opcode Fuzzy Hash: cfafcd6005c2c5ad4afabac6505ec1e77ba8af6c43e0e3a10c4edfb0307df8ed
Instruction Fuzzy Hash: 53210371504300DFDB95DF54D4C0B17BBA5FB84214F20C5AAEC894B242C336D447CB62

Function 063BA11F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c492980886f952e1aabf4b45846fdfa7db4b3e910a67e97e897c73464f0ddb
Instruction ID: 1f0d403ed98f77c588247ebb97a7339ce917e249e68742d304fd4e8e2cd640bd
Opcode Fuzzy Hash: 35c492980886f952e1aabf4b45846fdfa7db4b3e910a67e97e897c73464f0ddb
Instruction Fuzzy Hash: 94218771D002199FCB88DFA8C8546EEBBB2EF89300F10946AC115B7790CB394A09CFA0

Function 063BFEF9 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a7365d95fdedf6ab7cc7a02292435a11995708192d2e4e77e0244763c94a84
Instruction ID: e811ad287e9aea2e1c5b2cab1960a5fefd1fcc7857aa2482a6bc64ee36303e95
Opcode Fuzzy Hash: 11a7365d95fdedf6ab7cc7a02292435a11995708192d2e4e77e0244763c94a84
Instruction Fuzzy Hash: 1421F3706102018FC710EB78C4649EABBF5EFC5210B0489A9D506DB790EB70EC09CB91

Function 063BBF08 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9727f36f46bb559736fa1aca2353a7db6b881e79f29f75078816d705869e8765
Instruction ID: 5f89d9026251cab925daa614d1c2da4c2b38a0dba11fc146f733522aab1ada70
Opcode Fuzzy Hash: 9727f36f46bb559736fa1aca2353a7db6b881e79f29f75078816d705869e8765
Instruction Fuzzy Hash: 41213674D012189FCB45DFA4D818AEEBBF1FF49311F00956AE511B7240DB384A44CFA4

Function 063BA130 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7284f169edda5ac859245e56cb4a57ed7d347034d7a9b517fa69b7ff4dab2afb
Instruction ID: ad30ba83775fc1519b82c5ca6c7e019678e83b197a32eb34c31f570f167edc0b
Opcode Fuzzy Hash: 7284f169edda5ac859245e56cb4a57ed7d347034d7a9b517fa69b7ff4dab2afb
Instruction Fuzzy Hash: AB211570E002199FCB48DFA9C8546EEBBB2EF89310F00942AC515B7390DB395A45CFA4

Function 063BBF18 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9253b5645bf7130f489f63786ee3ce01c6721c589bd4492ad3ee31741c1fdd38
Instruction ID: e1a5ab0d06353455e50921f00a5af1d8196d5c6e3c4de9b7658b1b936919a700
Opcode Fuzzy Hash: 9253b5645bf7130f489f63786ee3ce01c6721c589bd4492ad3ee31741c1fdd38
Instruction Fuzzy Hash: AF21CF74D112299FCB54DFA9D848AEEBBF1BF89301F10942AE912B3740DB345A44CFA4

Function 0105D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1578558473.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2912e38f4deac7eacea8017974d56c039d5aa8cc37585f40f67efd65472b75c
Instruction ID: 20898105b869045504d06cfe9eac2167d7a69803a5b4e0788eb2821041b1d87a
Opcode Fuzzy Hash: c2912e38f4deac7eacea8017974d56c039d5aa8cc37585f40f67efd65472b75c
Instruction Fuzzy Hash: 5121D4755083808FCB43CF24C990705BFB1EB45214F28C5DBD8898B6A3C33AD40ACB62

Function 063BF9D0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d676adfd08343aaa67216725625bfdb11d34d30c7e27b7730131570765c0825
Instruction ID: 3ee200449ab5201ce39b38af7b65c3fd71f49fb89e9a0d213155731ab326617a
Opcode Fuzzy Hash: 3d676adfd08343aaa67216725625bfdb11d34d30c7e27b7730131570765c0825
Instruction Fuzzy Hash: C4111275E002499FCB48DFA8D951AEEBBB1FF89300F2051AAC520B7390CB305E05CBA1

Function 0104D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1578512875.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a772179decf110bb882872cb952e1b13b119dd61991aef1ad72797cf3e64a4
Instruction ID: 8f1e9d4f491bc3172df5e8cfa1f3da3b74e179db2d50174860b54e0d4478c38f
Opcode Fuzzy Hash: 01a772179decf110bb882872cb952e1b13b119dd61991aef1ad72797cf3e64a4
Instruction Fuzzy Hash: F711E1B6404240CFCB02CF54D5C4B56BFB1FB94324F24C2A9D8490B657C33AE45ACBA1

Function 063BF9E0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b81e792e7204e7a289fa7647f63fcda95bc68a976a35c8884fa97a43cf3142
Instruction ID: 01fcfef488dd120a81aa422b8cdbc53def3ee6423b670623767e583e383d6f02
Opcode Fuzzy Hash: c6b81e792e7204e7a289fa7647f63fcda95bc68a976a35c8884fa97a43cf3142
Instruction Fuzzy Hash: FA119D75E002199FCB48EFA8D854AEEB7B1BF89300F2091A9D915B7350DB316E05CBA5

Function 063BB490 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c724037a6e11b46d6ea5e4da0b34c975c4165e91bd350fb9bb42733d8af98d6
Instruction ID: b4d4a8419f4d90312943013d67ea5ce2177678825d1d4df06e38925e6bff9ce4
Opcode Fuzzy Hash: 8c724037a6e11b46d6ea5e4da0b34c975c4165e91bd350fb9bb42733d8af98d6
Instruction Fuzzy Hash: 2C117971E00209CFCB44CFA5D4446EEBBB1EF89310F10A06AD512B3740DB304989CBE1

Function 063BB4A0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d458f2cd404299515ccbd07a5133b8527e9072a7c0a9f221e531d5e799965235
Instruction ID: cb2b890aca26bab64da7947fd50fa3f83856449cc2d32c8f09de644616b7854c
Opcode Fuzzy Hash: d458f2cd404299515ccbd07a5133b8527e9072a7c0a9f221e531d5e799965235
Instruction Fuzzy Hash: 0311F575E002199FCB44DFA5D444AEEFBF1EB88310F10502AD515B3340EB359A84CBA5

Function 063BE5E9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0afaee2b69f29d00fd2a14c5e077d7a2420aa6e567af0ddf8e50f64b20ed2e17
Instruction ID: edf62313c215d3bf87ad318b32d8c64e77248060fbac12faf3adb32eb37aad15
Opcode Fuzzy Hash: 0afaee2b69f29d00fd2a14c5e077d7a2420aa6e567af0ddf8e50f64b20ed2e17
Instruction Fuzzy Hash: 7D113670C0624A8FCB55CFB4C444AEEBFB1FF06345F1085AAD511A3290C7394A46CF94

Function 063BCBCB Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd8e1aae476f7ca9ff4ec55c2eb408f835c349d0d7ad864231b4751656a19e6
Instruction ID: 2dc48f54141a57560db60a338d6efd34a5fc0a4784f146faf0d38707b5e17ad1
Opcode Fuzzy Hash: 6cd8e1aae476f7ca9ff4ec55c2eb408f835c349d0d7ad864231b4751656a19e6
Instruction Fuzzy Hash: 0A1166B0D0524A8FCB94DFB4C4546AEBFB1FB06300F1091AAD515A7290DB358A8ACF94

Function 063BCBD8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0bc4dcb6d7288e88de8912b1a04c0d9cd3096f0e8fb94e005af97373452ebf
Instruction ID: d95a6cdac31d94d53716d321a1d118505f25af1548372aea45092cafd64c25cf
Opcode Fuzzy Hash: 4c0bc4dcb6d7288e88de8912b1a04c0d9cd3096f0e8fb94e005af97373452ebf
Instruction Fuzzy Hash: 6711F3B0D01209DFCB98EFB8D4596AEBBB1FF09301F10946ED515A3280DB358A46CFA5

Function 0104DA09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1578512875.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3dcb357b0e6027522c92cd36fb9c90ecbbc2425d4d9767d837267a00903abf
Instruction ID: 3b02c7c0c874fd8249eec36ff31d935434132e0b1bc0e10b5e4fb83242bb2605
Opcode Fuzzy Hash: ff3dcb357b0e6027522c92cd36fb9c90ecbbc2425d4d9767d837267a00903abf
Instruction Fuzzy Hash: 1101A7B110C340EBE7208AA6C8C476ABFD8DF51634F18C56AED894A696C3799850C772

Function 063BE5F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab69345772753bbba0e935a10d9c56f518ac41e9a4b0c5e789003e84c762695
Instruction ID: 75a66b1855aa699ab6f16da7c465cec8632b73cbaf69a32fae3e6310bb09b91a
Opcode Fuzzy Hash: 7ab69345772753bbba0e935a10d9c56f518ac41e9a4b0c5e789003e84c762695
Instruction Fuzzy Hash: B611A270D01209DFCB94DFB8D4496AEBBF1FF09301F1094AAD515A3290D7399A45CF94

Function 063BB49E Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73aa512dcf479f87b22a93a5842dce00c0a514665f969f2975bc891c0c89cdd
Instruction ID: 90b5434556ef89e0d71d29e22fb281bc8d0f291c873438e7911372c3ed822876
Opcode Fuzzy Hash: f73aa512dcf479f87b22a93a5842dce00c0a514665f969f2975bc891c0c89cdd
Instruction Fuzzy Hash: 780113B5E002198FCB44DFA4D4446EEBBF1AF48310F10A42AD611B3740EB348A84CBE4

Function 063BC7F7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60351c12356eb00b4666afc0a7a9b69daf97953b035316a22095fee2fff5bd4a
Instruction ID: 441f1e953f7d2e4b0ec899cd7f37f89fbfda342617d7b3ad8a62b0f9488fd271
Opcode Fuzzy Hash: 60351c12356eb00b4666afc0a7a9b69daf97953b035316a22095fee2fff5bd4a
Instruction Fuzzy Hash: B301DC70D09355AFCBA1DFB8C8416DEBFB0EF02310B2096AAD820E7282D7394502CB81

Function 063BD8C0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10a482ccec854ce373e8944d69134ae645bcfd7b5bd2f4fe3ebe133726a242f
Instruction ID: 615a37bbbe8c78837379c2699ed13709713d2beb0415fc1ac2354d61698d1489
Opcode Fuzzy Hash: d10a482ccec854ce373e8944d69134ae645bcfd7b5bd2f4fe3ebe133726a242f
Instruction Fuzzy Hash: 0001A970C08389AFCBA1DFB8D80469DBFB0FF06305B545AAEC920EB691D7394505CB81

Function 0104DA08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1578512875.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae6138962040bd38beaf985c310df365a6e6e249c08964099773ecbc924e5fb
Instruction ID: 95320447b18d4ee660caf46e11f57befbe41462d7fa49d7a303fb9b795a76d1e
Opcode Fuzzy Hash: bae6138962040bd38beaf985c310df365a6e6e249c08964099773ecbc924e5fb
Instruction Fuzzy Hash: C2F0C2B2008340DFE7208A4AC8C4B66FFE8EB51634F18C05AED484B293C2799840CBB1

Function 063BE130 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecff17aaae0006f3fa7a43dfe2e48484264d322a6559d1f62dc4078b146f76a
Instruction ID: 7b15b6aabafb0ae997bb090c972df1259416db906884665406739742ff271a7c
Opcode Fuzzy Hash: aecff17aaae0006f3fa7a43dfe2e48484264d322a6559d1f62dc4078b146f76a
Instruction Fuzzy Hash: F1F09070C093959FCB56CFB8D80469EBFB0EF02310B1442EED460A76A1D7394601CB85

Function 063BC808 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0bf7447ea1ad5f2dddb3e2cf41ce70b2bdbed129f397632b15c5ddd43c7b79
Instruction ID: 4f0ba9b5eeb55d1421221f8111c77881b28537910a513533e9e05bf0098c812c
Opcode Fuzzy Hash: aa0bf7447ea1ad5f2dddb3e2cf41ce70b2bdbed129f397632b15c5ddd43c7b79
Instruction Fuzzy Hash: 04F01C70D01208EFCB94EFB8D8056EEBBF4FB05300F0095AAD825A3240EB744541CF84

Function 063BD8D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446d213b78201ae6205dc834c589a81b06152108f489f8f4613979afff198b2a
Instruction ID: 9b85dad98471af7eec2e710bd6170767173c49b8ed80fe20f30fddcdc47fcad3
Opcode Fuzzy Hash: 446d213b78201ae6205dc834c589a81b06152108f489f8f4613979afff198b2a
Instruction Fuzzy Hash: A9F01C70D013189FCB84EFB4D805AAEBBB4FF05300F4099AAD924E3240D7744640CF85

Function 063BE140 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc77905388eecd9c559b9372d92948331333b48f6f0cd90f75e22d054e7bed5
Instruction ID: 4f1f6a968c614999b9b7581f184e9b94c5b9dd097a5716ced68a070342b311c3
Opcode Fuzzy Hash: 7fc77905388eecd9c559b9372d92948331333b48f6f0cd90f75e22d054e7bed5
Instruction Fuzzy Hash: 7DF01C70D012089FCB84EFB8D805AAEBBB4FB05300F1095AAD424A3640E7754640CF84

Function 063BB388 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c78d51745c3e54a4d025ca2bcffdd55d140813a122beb3e4c80a70974e31d5
Instruction ID: 904c03d7b8eaa497b25b5e2fb5acfb16fb91a6db5a8fcedc7250fd439fcaab4d
Opcode Fuzzy Hash: 96c78d51745c3e54a4d025ca2bcffdd55d140813a122beb3e4c80a70974e31d5
Instruction Fuzzy Hash: E1F0A57098535ECFEB749F60D959BFDBB70AF02305F2024A9C10A66984DF748984CE95

Function 063BE025 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ba5cb33769200ac5fd333ac9ef000cac690fa65eeec40cdd183709ad55af09
Instruction ID: cdfb55043756346ffafa5a9300e13b8f26ca5af3130ebf2185db101de98b43e2
Opcode Fuzzy Hash: 89ba5cb33769200ac5fd333ac9ef000cac690fa65eeec40cdd183709ad55af09
Instruction Fuzzy Hash: 79F06D30D45319CFEB208F24C8587EEBB71BF46344F1038A9C2057A580CBB44984CF96

Non-executed Functions

Function 063B8C20 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367f26197e3cea17ee75ba1c6decfa97dc1d0d5e4a4f06750f714dcec8fb2f9b
Instruction ID: 7b545f3ab96452e0ba54ca02c2155f67cb2e69a55ef3b1cae7c1ddb67563c297
Opcode Fuzzy Hash: 367f26197e3cea17ee75ba1c6decfa97dc1d0d5e4a4f06750f714dcec8fb2f9b
Instruction Fuzzy Hash: 6942BE74E01229CFDB68DF64C854BDEB7B2BB89300F5091EAD54AAB250DB315E85CF90

Function 063B03A9 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77ea80b128ce6f19d390ea042fa6e349e66acc8767bc7dcc633541ebe634b8b
Instruction ID: c2a2201234883130942cf4798cd4f41d36eef55f9f151a8b456ef759107ba669
Opcode Fuzzy Hash: d77ea80b128ce6f19d390ea042fa6e349e66acc8767bc7dcc633541ebe634b8b
Instruction Fuzzy Hash: 75E12C74E403099BEB18DBB4D896BAEBB72FFC8700F806129E445AB395CE315D41DB64

Function 063B03B0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eea0f7fe150935eb80ac955dbf3da9a18d67de160d5873aa740aeece34fd57e
Instruction ID: 1c3228b58197b617ce2f95a873e50a909ca767ed79b696da04caf4824c9152af
Opcode Fuzzy Hash: 1eea0f7fe150935eb80ac955dbf3da9a18d67de160d5873aa740aeece34fd57e
Instruction Fuzzy Hash: E7E12C74E403099BEB18DBB4D896BAEBB72FFC8700F806129E445AB395CE315D41DB64

Function 063B7E78 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559c3c26637f86f6361cfb4a8f78d954271e28a67427e8f4e3eff74e590acd26
Instruction ID: 7690253820708b9df9916ee3f6e2b1afa7c641d347e74ac4cde17bab2bae7496
Opcode Fuzzy Hash: 559c3c26637f86f6361cfb4a8f78d954271e28a67427e8f4e3eff74e590acd26
Instruction Fuzzy Hash: 82F1D370A01229CFDB68DF64C850BDEBBB2BF89300F5095A9D549AB354DB315E85CF90

Function 063B9BE8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb7c92545ee04a929a701d8292ab3b99c042ddb6014e9ee841844e8e682a2ad
Instruction ID: 3197295006a19f42f2fb2cb05677250045b4c2d9a0387e45352ee28538b83c76
Opcode Fuzzy Hash: 3cb7c92545ee04a929a701d8292ab3b99c042ddb6014e9ee841844e8e682a2ad
Instruction Fuzzy Hash: 1AD1C174E01218CFDB68DFA5C884B9DBBB2FF8A301F1095AAD509A7354DB319985CF50

Function 063B7A10 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e257802abbf2d85f2322c4ae6fcd07f8b288a410e96efd96c906ed77e452e3f1
Instruction ID: dbb818922aee4074e076d42ad8b61f781f68424f216f2526e82c6442f3e7038b
Opcode Fuzzy Hash: e257802abbf2d85f2322c4ae6fcd07f8b288a410e96efd96c906ed77e452e3f1
Instruction Fuzzy Hash: FFD19E74E01218CFDB64CFA9D984B9DBBB2FF89300F1091AAD509AB355DB309A85CF50

Function 063B54C8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae11d0cb3251dc73dbba2552200b4dee8b94eaf4df0fc6d00d2bda8a38247bf
Instruction ID: d3921c8cb3d8c7828dacab1ae6c0f966a191334433d8bd877e4fdfbc5a5d6527
Opcode Fuzzy Hash: 5ae11d0cb3251dc73dbba2552200b4dee8b94eaf4df0fc6d00d2bda8a38247bf
Instruction Fuzzy Hash: 77B16A70E00209CFDB64CFA8C8857EDBBF2AF88324F149529E915E7694EB749845CF85

Function 063B84B8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032d58feba5dd63e7d451844f173709ecb531ef97148880707e9ab8b0348a07a
Instruction ID: d2b605ba6d73cfe39f2ecdf93c542b4a26c632cf869f2988a55f0ebcd2a74040
Opcode Fuzzy Hash: 032d58feba5dd63e7d451844f173709ecb531ef97148880707e9ab8b0348a07a
Instruction Fuzzy Hash: 20C1E570D01229CFEB68DF65C954BDEBBB6BF89300F5091EAC509AB250DB315A85CF90

Function 063B5D98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1fad72cd14bbcd204febbbf7ae7cf1ff84658a1c5e2eeafdb90ffbeb774d7f
Instruction ID: 55828806db8fd897cd8f4c8f93232d62ca1222dbc145dc6a60319cbbe3f05f18
Opcode Fuzzy Hash: 8b1fad72cd14bbcd204febbbf7ae7cf1ff84658a1c5e2eeafdb90ffbeb774d7f
Instruction Fuzzy Hash: 21B19D70E04209CFDF64CFA9C8817EDBBF2AF88314F14A529E914E7694EB759845CB81

Function 0121DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1579109894.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1d1052519e535a70da0ea7d45e5031418203badd09a7737724d2fb0e628f12
Instruction ID: 44daa4c50e66c192210f3e6430b9fc0ce584a9cacdb5264cf325505bba97f5e6
Opcode Fuzzy Hash: ae1d1052519e535a70da0ea7d45e5031418203badd09a7737724d2fb0e628f12
Instruction Fuzzy Hash: 84A16F32A1021ACFCF05DFB4D9445EEBBF2FF94300B15856AE915AB269DB71D905CB80

Function 063B5180 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8008d193cb9917de3716bfdad35c590fd323c48d3229af2cc216742a1e042a1e
Instruction ID: 3fbf013e6aeb0b46c2dbacf45ed53cb9e0e239aa18436bd5b0cc9d06952713b7
Opcode Fuzzy Hash: 8008d193cb9917de3716bfdad35c590fd323c48d3229af2cc216742a1e042a1e
Instruction Fuzzy Hash: 03917C70E00209DFDF64CFA9C8857DEBBF2AF88324F149529E505AB694EB749845CB81

Function 063B2190 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cb508389ca1f6bab07e39f54165f297a68f0705316d4d3065adc7b30e7e352
Instruction ID: c91e4145dcfac361a6f825d8f38f58a1b9ce01c85d9b37c3f3d6862a68f66051
Opcode Fuzzy Hash: 49cb508389ca1f6bab07e39f54165f297a68f0705316d4d3065adc7b30e7e352
Instruction Fuzzy Hash: DF61E370E01218DFDB44DFA5C484ADDBBB2FF89300F649169D505BB260DB30A946CF94

Function 063BF440 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9a35dcb8227b78a0c512f8c8dbd3b81dfc5018e59030d599b48eff36e34be7
Instruction ID: ba3d987d89caf8dc3b6e18c0db3edded8d4ec28083bd74787547cefe78109f37
Opcode Fuzzy Hash: 4d9a35dcb8227b78a0c512f8c8dbd3b81dfc5018e59030d599b48eff36e34be7
Instruction Fuzzy Hash: 5191E570E01228CFEB68DF65C954B9EBBB2BF89300F1091EAC149AB254DB354E85DF51

Function 063B84A7 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab779e16c2a0cedc41ff07f01a3b625123eeef24dd2ab93567d93ecf821d8535
Instruction ID: 3c0da1364d7a1f5f4084d3fa8ce39f5676b72b4ad8c77e3fa59e741d0aeedabc
Opcode Fuzzy Hash: ab779e16c2a0cedc41ff07f01a3b625123eeef24dd2ab93567d93ecf821d8535
Instruction Fuzzy Hash: 2591D570D012298FEB68DF65C954BDEBBB2BF88300F10C1EAD549AB250DB354A85DF90

Function 063BB52F Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3defea95b0a18d1a13f5a933b1a81fa0de7311319b7e92b64f6fe5b50eba20c1
Instruction ID: 2ce2528ce41d3c7ed96de956bff3a1c571d2388b4c024b89d5d96d74c951d086
Opcode Fuzzy Hash: 3defea95b0a18d1a13f5a933b1a81fa0de7311319b7e92b64f6fe5b50eba20c1
Instruction Fuzzy Hash: E961E771E00218CFEB68DF65C941BDEBBB2BF88300F1091A9D509AB254DB315E86CF91

Function 063B950B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee76fb327525fb27203f7abad7a40db22f6e531d71dcd33784cb2bcb172873
Instruction ID: df70114d75a9e2f9681cc7ce1689211657d8f21955afc447ccb98f071420b234
Opcode Fuzzy Hash: 81ee76fb327525fb27203f7abad7a40db22f6e531d71dcd33784cb2bcb172873
Instruction Fuzzy Hash: 42E09230C8910ECEEB14CF61D0007FEFA786B86304F607406CA05B7A80CB7086448EE9

Function 063BF39C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1586254406.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_w4oDGAPUMH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334d209ccdcda51c6a1f3a6579d39c4aa1d01cb66c9b96cef7ac6afd01aeb381
Instruction ID: eb14750a136cab42a4328c7da0b5f320d886749ad8a5b266788e254839d521b6
Opcode Fuzzy Hash: 334d209ccdcda51c6a1f3a6579d39c4aa1d01cb66c9b96cef7ac6afd01aeb381
Instruction Fuzzy Hash: 72F0C970C44219CFEB608F50DC597FDBA74AB06309F107459D20A73995C7B44685CFD5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report w4oDGAPUMH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\w4oDGAPUMH.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
w4oDGAPUMH.exe

Function 063BE6E0 Relevance: 2.0, Strings: 1, Instructions: 759
COMMON

Function 063BF450 Relevance: 1.6, Strings: 1, Instructions: 323
COMMON

Function 0121AE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 01214248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 01215935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 0121C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0121D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 01219838 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 06A31B08 Relevance: 1.5, Instructions: 1467
COMMON

Function 063BC8E0 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Function 063BC8F0 Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Function 06A30048 Relevance: .7, Instructions: 676
COMMON

Function 06A33980 Relevance: .7, Instructions: 660
COMMON

Function 06A30CF0 Relevance: .6, Instructions: 608
COMMON