Edit tour

Windows Analysis Report
1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Overview

General Information

Sample name:	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
Analysis ID:	1446228
MD5:	1fb1c8da0fabb641a76ac6759dd557dd
SHA1:	eac9ef0a2bb9058efcc01242184f7a10136a5036
SHA256:	2f05df98b8de8af85942d15c1c7d434ee62be3e3662c551a0e14d29c9531c1cc
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe (PID: 6368 cmdline: "C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe" MD5: 1FB1C8DA0FABB641A76AC6759DD557DD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["5.42.65.115:40551"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1978943638.00000000006B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe PID: 6368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe PID: 6368	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe.6b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 5.42.65.115

Timestamp:	05/23/24-01:26:06.551496
SID:	2043231
Source Port:	49704
Destination Port:	40551
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.115 - Destination IP: 192.168.2.5

Timestamp:	05/23/24-01:25:54.736899
SID:	2043234
Source Port:	40551
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 5.42.65.115

Timestamp:	05/23/24-01:25:54.541221
SID:	2046045
Source Port:	49704
Destination Port:	40551
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.115 - Destination IP: 192.168.2.5

Timestamp:	05/23/24-01:25:59.978697
SID:	2046056
Source Port:	40551
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.115:40551"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 5.42.65.115:40551
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 5.42.65.115:40551
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.115:40551 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.115:40551 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.115:40551

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 5.42.65.115:40551

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9m
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp, 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002C08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	String found in binary or memory: https://api.ip.sb/ip
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp63B6.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp63A5.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_00F825D8	0_2_00F825D8
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_00F8DC74	0_2_00F8DC74
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061B67D8	0_2_061B67D8
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061BA3E8	0_2_061BA3E8
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061B3F50	0_2_061B3F50
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061BA3D8	0_2_061BA3D8
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061B6FF8	0_2_061B6FF8
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061B6FE8	0_2_061B6FE8

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000000.1978970738.00000000006F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameChazan.exe8 vs 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2119831626.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Binary or memory string: OriginalFilenameChazan.exe8 vs 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp63A5.tmp

Jump to behavior

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Static PE information: 0xF821E471 [Fri Dec 2 12:45:37 2101 UTC]

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061BE060 push es; ret		0_2_061BE070
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Code function: 0_2_061BECF2 push eax; ret		0_2_061BED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Memory allocated: F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Window / User API: threadDelayed 1261			Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Window / User API: threadDelayed 4130			Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe TID: 4320	Thread sleep time: -16602069666338586s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe TID: 2828	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2128553933.0000000006247000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1978943638.00000000006B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe PID: 6368, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe PID: 6368, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1978943638.00000000006B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe PID: 6368, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8ResponseD	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002C08000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2123262202.0000000003B1B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe, 00000000.00000002.2120396271.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.115	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446228
Start date and time:	2024-05-23 01:25:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 87 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Simulations

Behavior and APIs

Time	Type	Description
19:26:02	API Interceptor	29x Sleep call for process: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.42.65.115	Pp8XG0Vz4D.exe	Get hash	malicious	GCleaner	Browse	5.42.65.115/advdlc.php
	mxsujj4FZz.exe	Get hash	malicious	GCleaner, RedLine	Browse	5.42.65.115/advdlc.php
	UzMahCzo58.exe	Get hash	malicious	LummaC, GCleaner, LummaC Stealer	Browse	5.42.65.115/advdlc.php
	hkXE3abs6j.exe	Get hash	malicious	GCleaner, RedLine	Browse	5.42.65.115/advdlc.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.115
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.115
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse	5.42.96.170
	file.exe	Get hash	malicious	Unknown	Browse	5.42.66.10
	http://0nline.jjwconstructlon.com	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	file.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.64

Process:	C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:53 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4510501830169997
Encrypted:	false
SSDEEP:	48:8SCLl2dfTXdARYrnvPdAKRkdAGdAKRFdAKRE:8SmlO7
MD5:	2B6BCB85EF126111594F90D34DBCA614
SHA1:	1CB14AB3B46898BC0E7F82D17752B723F2EACBE6
SHA-256:	8B6548718CAD5DFA8A0157597E0AEFB73B2FFE38C4EDBD31A3E9B1F2145581BD
SHA-512:	7C2F18D22B18B553F100BB219C729640D0EBF07790ADD06F8B3D8002B412E9CD8F175505D265C604E9F57AE8F4DF77A9A0D8ACAA6F1B45341F63DB174335590B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......Tl.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe.log

Download File

Process:	C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp63A5.tmp

Download File

Process:	C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp63B6.tmp

Download File

Process:	C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.082669296180613
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
File size:	311'296 bytes
MD5:	1fb1c8da0fabb641a76ac6759dd557dd
SHA1:	eac9ef0a2bb9058efcc01242184f7a10136a5036
SHA256:	2f05df98b8de8af85942d15c1c7d434ee62be3e3662c551a0e14d29c9531c1cc
SHA512:	44623c837f1537783e44703637407b3330db2201800f0ab5d2552f3b67368b320734e1fa12143c1ed9df75518c641817039bec7ec74c2c18d4efe22dd83739cd
SSDEEP:	3072:1q6EgY6iHrUj1DeewPMAVTmz+qGwRTAAtpSKGscZqf7D341eqiOLibBOp:8qY6iwwPv9priTA8pIscZqf7DIfL
TLSH:	45646D1867EC8911E27F4B399471E2749375EC16A552E30F4ED06CEB3E32741FA21AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.!...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42ba12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF821E471 [Fri Dec 2 12:45:37 2101 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007FF6414CEF32h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007FF6414CEF32h
jnc 00007FF6414CEF32h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007FF6414CEF32h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007FF6414CEF32h
je 00007FF6414CEF32h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007FF6414CEF32h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007FF6414CEF32h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b9c0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b9a4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e9f8	0x2ec00	cb1d7e717f9d504234ecd59dbd039d9a	False	0.4699354528743315	data	6.205942019428129	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c4	0x1cc00	5c2a18af3bb2f0833cb4c554a40e7d18	False	0.23721127717391305	data	2.6057163374034773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	0d4caa3e42efbd58c8173a63647ce47a	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x34a	data	0.44655581947743467
RT_MANIFEST	0x4e7d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/23/24-01:26:06.551496	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	40551	192.168.2.5	5.42.65.115
05/23/24-01:25:54.736899	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	40551	49704	5.42.65.115	192.168.2.5
05/23/24-01:25:54.541221	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49704	40551	192.168.2.5	5.42.65.115
05/23/24-01:25:59.978697	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	40551	49704	5.42.65.115	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 01:25:53.839518070 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:53.844722033 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:53.844815016 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:53.852116108 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:53.901091099 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:54.503212929 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:54.541220903 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:54.550211906 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:54.736898899 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:54.778626919 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:59.782186985 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:59.788669109 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.978697062 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.980798960 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.981067896 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:59.985563993 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.990345955 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.990355968 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.990546942 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:25:59.995492935 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:25:59.995695114 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:00.033468008 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.033688068 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:00.109231949 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:00.114202976 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.300595045 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.310117006 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:00.315037966 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.500782013 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.506823063 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:00.511953115 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.700232983 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.701672077 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:00.709903955 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.905726910 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:00.950309038 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:01.141050100 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:01.146605015 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.338213921 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.349251032 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:01.354684114 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.545243025 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.547732115 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:01.603475094 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.931154013 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.981683016 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:01.992396116 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:01.992486000 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.003787994 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.009432077 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.009628057 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.014103889 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014152050 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014180899 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014209986 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014236927 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014265060 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014292955 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014321089 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014349937 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.014377117 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.019064903 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.068111897 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.296174049 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.298316956 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.303670883 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.491446972 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.496192932 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.503324032 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.691325903 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.715863943 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.721098900 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.906939030 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:02.950316906 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:02.966197968 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:03.002996922 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:03.219295979 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:03.262916088 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:04.081746101 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:04.093198061 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.280281067 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.284749985 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:04.296641111 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296649933 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296657085 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296664000 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296672106 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296678066 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296684980 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.296693087 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.495383978 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.499396086 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:04.547338963 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.690326929 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.694370031 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:04.699479103 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:04.976447105 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.028502941 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.055742025 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.060992956 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.061070919 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.065777063 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.065807104 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.065839052 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.065861940 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.065881014 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.065908909 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.065931082 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.065960884 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.065978050 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066005945 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066026926 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.066055059 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.066082001 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066111088 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066152096 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066167116 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.066200018 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.066225052 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066251993 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.066293955 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.066293955 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070564032 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070596933 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070620060 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070647955 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070667982 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070698023 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070714951 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070741892 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070771933 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070795059 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070827007 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070852995 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070878029 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070908070 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.070935965 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070962906 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.070986032 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071012020 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071042061 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071069956 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071094036 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071120024 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071152925 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071182013 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071209908 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071286917 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071865082 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071893930 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071934938 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.071964025 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.071991920 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072011948 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072042942 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072063923 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072094917 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072118998 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072145939 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072170973 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072197914 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072217941 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072243929 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072266102 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072293043 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072316885 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072338104 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072360992 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072386980 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072408915 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072432041 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072455883 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072484016 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072504997 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072536945 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072561979 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072588921 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072608948 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072633028 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072654963 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072681904 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072704077 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072726965 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072751999 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072778940 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072798967 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072824001 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.072845936 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.072896957 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.075964928 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.076046944 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077204943 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077231884 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077254057 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077280045 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077300072 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077327967 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077347994 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077379942 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077400923 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077429056 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077449083 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077471972 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077495098 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077522039 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077545881 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077574015 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077596903 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077625990 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077647924 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077672958 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077694893 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077722073 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077744007 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077774048 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077790976 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077820063 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077841997 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077867985 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077893972 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077922106 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.077944040 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077970982 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.077996969 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078022957 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078063011 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078092098 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078119040 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078140020 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078162909 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078185081 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078227997 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078794956 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078826904 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078849077 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078885078 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078907013 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078934908 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.078955889 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.078977108 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079001904 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079029083 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079051018 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079073906 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079097033 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079123974 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079144001 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079170942 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079195023 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079221964 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079242945 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079265118 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079288006 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079314947 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079338074 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079365969 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079391003 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079417944 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079457045 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079472065 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079500914 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079525948 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079555035 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079575062 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079598904 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079621077 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079647064 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079674959 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079693079 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079719067 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079745054 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079766989 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079792023 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.079818964 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.079869986 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.080709934 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.080741882 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.080764055 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.080787897 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.083959103 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.083986998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084007978 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084033966 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084064960 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084088087 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084108114 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084135056 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084163904 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084184885 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084204912 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084232092 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084252119 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084280968 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084302902 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084330082 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084352970 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084378004 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084407091 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084428072 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084451914 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084479094 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084501982 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084532022 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084553957 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084580898 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084603071 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084625006 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084647894 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084675074 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084698915 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084718943 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084743977 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084772110 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084793091 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084815979 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084840059 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084867954 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.084889889 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084913015 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.084938049 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085000992 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085303068 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085335016 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085361004 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085386992 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085406065 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085432053 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085457087 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085474968 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085500002 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085527897 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085549116 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085570097 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085594893 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085621119 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085642099 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085661888 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085686922 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085714102 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085738897 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085758924 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085800886 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085829020 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085851908 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085874081 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085897923 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085925102 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.085944891 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085974932 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.085994005 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086020947 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086040974 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086071014 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086087942 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086113930 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086137056 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086164951 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086182117 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086208105 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086232901 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086251020 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086276054 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086302996 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086327076 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086349964 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086379051 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086410046 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086431026 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086458921 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086477995 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086512089 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086533070 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086558104 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.086580992 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.086623907 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090219975 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090250969 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090275049 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090298891 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090322018 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090348959 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090373039 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090393066 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090418100 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090444088 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090471029 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090523958 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.090558052 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.090610027 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.091847897 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.091876030 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.091900110 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.091931105 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.091959000 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.091985941 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092012882 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092045069 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092073917 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092099905 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092127085 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092154026 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092195988 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092220068 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092255116 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092282057 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092304945 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092328072 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092350960 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092376947 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092396021 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092413902 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092439890 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092466116 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092488050 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092520952 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092547894 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092575073 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092596054 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092621088 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092645884 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092672110 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092691898 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092741013 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092776060 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092796087 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092813015 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092839956 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092859030 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092881918 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092905998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092931986 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.092955112 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.092974901 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093000889 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093027115 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093049049 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093071938 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093101025 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093127012 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093147993 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093173981 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093194008 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093219995 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093242884 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093266964 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093291998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093318939 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093338966 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093367100 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093384981 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093410969 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093430042 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093455076 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093476057 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093502045 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093525887 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093544960 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093569994 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093596935 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093621969 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093643904 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093667984 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093694925 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093714952 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093733072 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.093758106 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.093810081 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.095885992 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.095920086 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.095942020 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.095967054 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.095988035 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.096014977 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.096036911 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.096057892 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.096081972 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.096110106 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.096136093 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.096158028 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.100675106 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100703001 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100739002 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100761890 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.100761890 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.100807905 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100833893 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100861073 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100887060 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100913048 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100939989 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100965977 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.100992918 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101021051 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101048946 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101077080 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101118088 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101140976 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101174116 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101174116 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101217985 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101243973 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101264000 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101290941 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101310015 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101336956 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101356983 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101381063 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101402998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101449966 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101586103 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101613045 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101632118 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101655006 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101679087 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101705074 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101725101 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101747990 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101772070 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101799011 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101819992 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101846933 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101866007 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101892948 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101927042 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101927042 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.101969957 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.101996899 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102015972 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102039099 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102063894 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102092981 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102121115 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102142096 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102166891 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102194071 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102215052 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102236032 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102261066 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102288008 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102308035 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102329969 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102360964 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102391958 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102411985 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102433920 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102458954 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102504969 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102529049 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102555990 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.102577925 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.102601051 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105469942 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105504990 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105526924 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105551004 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105576038 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105602026 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105623007 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105650902 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105669975 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105696917 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105720043 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105746031 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105772972 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105799913 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105820894 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105839968 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105865002 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105891943 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105911016 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105937958 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.105957985 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.105983019 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106004953 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.106035948 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106062889 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106090069 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106117964 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106143951 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106173038 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106199980 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.106225967 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108366966 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108396053 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108423948 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108449936 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108478069 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108505011 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108531952 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108572960 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108614922 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108653069 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108690023 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108716965 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108737946 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108762026 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108784914 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108812094 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108830929 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108854055 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108876944 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108903885 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108925104 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108947992 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.108971119 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.108999014 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109019995 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109045982 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109071970 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109102011 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109119892 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109144926 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109164953 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109193087 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109213114 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109236956 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109261036 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109302998 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109329939 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109360933 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109374046 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109401941 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109420061 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109447956 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109467983 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109488964 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109514952 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109540939 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109561920 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109582901 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109606981 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109632969 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109673023 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109673023 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109709978 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109736919 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109760046 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109792948 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109817982 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109844923 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109867096 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109894037 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109920979 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109947920 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.109968901 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.109991074 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.110017061 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110045910 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110064983 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.110088110 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.110110998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110137939 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110161066 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.110182047 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.110207081 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110233068 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110256910 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.110285997 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.110312939 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.111974955 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116039991 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116070032 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116096973 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116123915 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116149902 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116175890 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116203070 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116230011 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116256952 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116282940 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116309881 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116336107 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116363049 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116389990 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116416931 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116444111 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116471052 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116516113 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116564989 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116600037 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116628885 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116648912 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116677046 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116694927 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116720915 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116741896 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116772890 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116816998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116858959 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116873026 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116900921 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116920948 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116947889 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.116969109 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.116990089 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117014885 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117042065 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117068052 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117094994 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117119074 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117146015 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117172003 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117192030 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117217064 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117244005 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117265940 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117284060 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117307901 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117335081 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117355108 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117377043 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117400885 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117428064 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117446899 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117470026 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117494106 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117522001 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117539883 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117568016 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117593050 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117620945 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117640018 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117664099 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117687941 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117716074 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117737055 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117763042 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117786884 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117814064 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117835045 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117854118 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117878914 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117906094 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.117928028 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117954016 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.117980003 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.118011951 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.122883081 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.122912884 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.122941017 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.122967005 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.122993946 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123020887 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123049974 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123076916 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123104095 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123131037 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123157978 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123184919 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123213053 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123239040 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123265982 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123294115 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123321056 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123347998 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123557091 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123586893 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123614073 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123641014 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123670101 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123737097 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.123789072 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.123825073 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123852015 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123876095 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.123893976 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.123918056 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123944044 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.123963118 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.123986959 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124007940 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124034882 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124057055 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124084949 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124102116 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124128103 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124147892 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124171019 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124196053 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124222994 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124243021 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124272108 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124290943 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124317884 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124351025 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124382973 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124404907 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124433041 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124453068 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124485970 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124505997 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124533892 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.124553919 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.124581099 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.127625942 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.127657890 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.127677917 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.127707005 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.127724886 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.127752066 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.127772093 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.127800941 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.168240070 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.168329000 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.168495893 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.168598890 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.216346025 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.216609001 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:05.221713066 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267376900 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267417908 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267446041 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267476082 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267503977 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267530918 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.267558098 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.891268015 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:05.934684038 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:06.168905973 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:06.174000978 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:06.359443903 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:06.360224009 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:06.365344048 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:06.550805092 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:06.551496029 CEST	49704	40551	192.168.2.5	5.42.65.115
May 23, 2024 01:26:06.556529045 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:06.746830940 CEST	40551	49704	5.42.65.115	192.168.2.5
May 23, 2024 01:26:06.781287909 CEST	49704	40551	192.168.2.5	5.42.65.115

Target ID:	0
Start time:	19:25:51
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe"
Imagebase:	0x6b0000
File size:	311'296 bytes
MD5 hash:	1FB1C8DA0FABB641A76AC6759DD557DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1978943638.00000000006B2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2120396271.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exePID: 6368, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	8

Executed Functions

Function 061B3F50 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061B41E4

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 320a1dcd7f730f89a1ede60273842f70db57980a9df2a08e8265412827eba502
Instruction ID: 7cc4b3b9c386a07931debd7b438abaeb64167160d146a66ad55307c08bedb284
Opcode Fuzzy Hash: 320a1dcd7f730f89a1ede60273842f70db57980a9df2a08e8265412827eba502
Instruction Fuzzy Hash: B1126D34B002159FDB55DF79C984AAEBBF6BF88700B158569E406EB365DB30EC42CB90

Function 061B67D8 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9adf83eb4f7037ccaa6a75ce6cf2fb9f27a8d9a75e7e24aabfc9fcf003ab74a7
Instruction ID: 603099de3da755ee88fe68ff920cd7f7461bf72ebfd66ffb819b3fc5891f80a8
Opcode Fuzzy Hash: 9adf83eb4f7037ccaa6a75ce6cf2fb9f27a8d9a75e7e24aabfc9fcf003ab74a7
Instruction Fuzzy Hash: C9F1CE31A002099FDB15DFA8D984BDEBBF6EF88310F148569E405EB2A1DB34ED45CB90

Function 061BA3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aa7420be1a6b14bb7596cce5ee1331d14b07d268a5c685190797123a72618c
Instruction ID: a046f01666175b76c0e1ac7122ac50edd7ffa4d8d93710f1cf6c42e4fc0c2062
Opcode Fuzzy Hash: 38aa7420be1a6b14bb7596cce5ee1331d14b07d268a5c685190797123a72618c
Instruction Fuzzy Hash: 51D10630D00619CFCB68EFB5D8486ADBBB2FF8A301F1095A9D50AAB254DB315986CF51

Function 061BA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808c0a1f90ea6ccc02a1001bbeaf6a1f11f4298a681339ba94a65146c8173d2c
Instruction ID: a23a4e7a3e99bfd390b84e83a7b69d21b69d2884cdaaa337ee1a0baae966f674
Opcode Fuzzy Hash: 808c0a1f90ea6ccc02a1001bbeaf6a1f11f4298a681339ba94a65146c8173d2c
Instruction Fuzzy Hash: 9AD1F630E00619CFCB68EFB5D8486ADBBB3FF8A301F1095A9D51AA7254DB315985CF41

Function 061A0D80 Relevance: 20.6, Strings: 16, Instructions: 625
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061A0F36
$]q, xrefs: 061A1455
$]q, xrefs: 061A0E02
$]q, xrefs: 061A0FAC
$]q, xrefs: 061A0E78
$]q, xrefs: 061A1461
$]q, xrefs: 061A137B
$]q, xrefs: 061A1336
$]q, xrefs: 061A13A0
$]q, xrefs: 061A13EB
$]q, xrefs: 061A0F86
$]q, xrefs: 061A0FB8
$]q, xrefs: 061A0E84
$]q, xrefs: 061A13AC
$]q, xrefs: 061A1430
$]q, xrefs: 061A0E52

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2551331179
Opcode ID: 1167eb7a49484917ced0bd0516685655284916e91489e075c095db86335406b3
Instruction ID: c67f07ac596cbd4c0bd6be7138516f8767a58676d908897d19d08d55e07efd17
Opcode Fuzzy Hash: 1167eb7a49484917ced0bd0516685655284916e91489e075c095db86335406b3
Instruction Fuzzy Hash: B232C134B003059FDB589B69C94997EBBF6BF89204F11886AE506CB7A6CF34DC01CB91

Function 061A1582 Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061A1A12
$]q, xrefs: 061A18E3
$]q, xrefs: 061A182E
$]q, xrefs: 061A1A88
$]q, xrefs: 061A1A57
$]q, xrefs: 061A1A7C

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: f329cfd9b1ffad1088db016a26f22b824ba4fc53d6f33e6b1a9ab429914fc74e
Instruction ID: 4140fd3a89e396d9f52f3eda2374f420d195691252a94ef8b3e3c2428f60719f
Opcode Fuzzy Hash: f329cfd9b1ffad1088db016a26f22b824ba4fc53d6f33e6b1a9ab429914fc74e
Instruction Fuzzy Hash: 04C1F138B043459FDB589BA8C895A2E7BE6EF89704F108869E503CB7A2DF74DC05C791

Function 00F8AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8B086

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 24cee8814620a32179b3ce9d53bf7f5c582003cfd04ff4ba3598365087320e81
Instruction ID: 806e01db5b4c57c7063f80d9d4741cffa71fb8870ce1e6a80c5f9044a3772bd3
Opcode Fuzzy Hash: 24cee8814620a32179b3ce9d53bf7f5c582003cfd04ff4ba3598365087320e81
Instruction Fuzzy Hash: 0E7169B0A00B458FE724EF2AD44579ABBF1FF88310F00892EE54AC7A40D775E945DB91

Function 00F85935 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859F1

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a461b54516394d4321b4bdd8cf654fdf47706e53a481fcedfe16c5d5cdb18112
Instruction ID: 9dc64e6b083e9a91103bc79bada4a433d7c30e84857fa8a8d5443b31eb84e5de
Opcode Fuzzy Hash: a461b54516394d4321b4bdd8cf654fdf47706e53a481fcedfe16c5d5cdb18112
Instruction Fuzzy Hash: 10410DB0C00619CBDB28DFA9C884BCDBBF5FF49714F20816AD408AB255DB75694ACF91

Function 00F84248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859F1

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bbf6be0da063b1d93be6ebeb81df923ce321d38553abaace46ad7804c61aaa26
Instruction ID: 220e8018c7bfc948b919082bc44c9a5a026c5c33a881ef2d6f006c6702e12216
Opcode Fuzzy Hash: bbf6be0da063b1d93be6ebeb81df923ce321d38553abaace46ad7804c61aaa26
Instruction Fuzzy Hash: 1E4101B0D00619CBDB24DFA9C884BCDBBB5FF48714F20806AD408AB255DB75694ACF91

Function 00F8C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F8D2C6,?,?,?,?,?), ref: 00F8D387

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: deb7e8b772546129d3cb90f96c57b5d0460d84cf23a84c690a1abeb4f6faaded
Instruction ID: d4dc9019841439d80d638ef2acdd7a164837d7f835bb574d870ad1bfd1d5ba18
Opcode Fuzzy Hash: deb7e8b772546129d3cb90f96c57b5d0460d84cf23a84c690a1abeb4f6faaded
Instruction Fuzzy Hash: 9B21E6B59002089FDB10DF9AD984ADEFBF5FF48310F14801AE918A3350D379A954DFA5

Function 00F8D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F8D2C6,?,?,?,?,?), ref: 00F8D387

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1de6035241bf05b45883b0f6cb118617b8ce43361fcd57736d06843ebfbc21fe
Instruction ID: 22480ba4e0404b421466dce8e132688ab66da27a55fd6d822992f82668f6694f
Opcode Fuzzy Hash: 1de6035241bf05b45883b0f6cb118617b8ce43361fcd57736d06843ebfbc21fe
Instruction Fuzzy Hash: 7121E3B59002089FDB10DFAAD585ADEBBF5EB48310F14801AE918A3350D379A944CFA1

Function 00F8A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F8B101,00000800,00000000,00000000), ref: 00F8B312

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: eb83d8f3c6f7114c47d4f5e1c7614f4ab3482a59d8172b354ed83dcd3b90310e
Instruction ID: b181771c0c3d1389abcd4f7e641a810117e18331870a29598b762e44d43bc532
Opcode Fuzzy Hash: eb83d8f3c6f7114c47d4f5e1c7614f4ab3482a59d8172b354ed83dcd3b90310e
Instruction Fuzzy Hash: AB1114B6C003499FDB10DF9AC444ADEFBF4EB48320F10842AE519A7300C379A945CFA5

Function 00F8B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F8B101,00000800,00000000,00000000), ref: 00F8B312

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 05f15130d2dd2454bda2bf861ae756fb6d0bfb0f13fef9cf54460fb6da49bfbe
Instruction ID: 5490d995ed9627843c8b0abdf0507613d85bd94a948a50a52063c841063b359c
Opcode Fuzzy Hash: 05f15130d2dd2454bda2bf861ae756fb6d0bfb0f13fef9cf54460fb6da49bfbe
Instruction Fuzzy Hash: D21112B6C002498FDB10DFAAC444ADEFBF4EF88320F14842AE819A7311C379A545CFA1

Function 00F8B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8B086

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eb40ca243d967609228faf59df570c0b6d74dbc2217e69fe5a9566563bc32c81
Instruction ID: 99d5c400e29944836415fa67acd3d2a2bd98e2a9ffa592bc0fbd0175007d5543
Opcode Fuzzy Hash: eb40ca243d967609228faf59df570c0b6d74dbc2217e69fe5a9566563bc32c81
Instruction Fuzzy Hash: B211DFB5C003498FDB20DF9AC844ADEFBF5AB89320F14841AD469B7611D379A549CFA1

Function 061B59D8 Relevance: 1.5, Strings: 1, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 061B5C29

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: e0dd1a5f0dca03516458ab39c9b052f9b88915882c3b68a7b22aba941f2fa93e
Instruction ID: e227ca0795793428bb632f6340634214a1b836641f61e79d4c0c2c4ded24ba2e
Opcode Fuzzy Hash: e0dd1a5f0dca03516458ab39c9b052f9b88915882c3b68a7b22aba941f2fa93e
Instruction Fuzzy Hash: 9FC18D34600602CFC755CF28C5909AABBF7FF89310B19C999D45A9B666D730FC46CB94

Function 061A1BA0 Relevance: 1.5, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189a8a1e0ea0bbfa69de5630953742defacee98e4b6af7449c03de096c5d86a5
Instruction ID: 94adb629b7be4887bfe24488ceaf8874aba29996382727991d0292f9482012c4
Opcode Fuzzy Hash: 189a8a1e0ea0bbfa69de5630953742defacee98e4b6af7449c03de096c5d86a5
Instruction Fuzzy Hash: 54C24C74B402189FDB55DF68C950EAEBBB6EF88700F108099E506AB3A1DF71AE41CF51

Function 061B3DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4']q, xrefs: 061B3F25

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 6b770a0ea1db4e2a2e1c7ad433ea0c0b474f6e09dd64f35ea97dcf12d0aaad5a
Instruction ID: fc63f2bfb25aaf27469f1fca3e44e9d41b5f7474f7f4e4065a36ac812cbfd1d8
Opcode Fuzzy Hash: 6b770a0ea1db4e2a2e1c7ad433ea0c0b474f6e09dd64f35ea97dcf12d0aaad5a
Instruction Fuzzy Hash: 6B31F3327002508FC759AB38E490AAE77EAEFCA31070548AAD449CB754DF35EC0BC7A0

Function 061B84D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4']q, xrefs: 061B85B1

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: db58559625eab1c21f68c8be8eed0ba09ac4f66a93c26b277cb612fc394efeba
Instruction ID: 949d2e625d46aee44cf243e534d04e0bb7879f47bc48af5b284c4bbd96887fed
Opcode Fuzzy Hash: db58559625eab1c21f68c8be8eed0ba09ac4f66a93c26b277cb612fc394efeba
Instruction Fuzzy Hash: 82317F307002048FDB08BBB994A45AE7BE7EFC8211B504439D51ADB394EF759E0287E6

Function 061B84C8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4']q, xrefs: 061B85B1

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 6ddc1dfdce584927db7e3029899622969a79c839d48a78b4ff4551ff10975383
Instruction ID: 328ea7b6f466f1d9aae3cbcff9ea3ea1e5cffa06e94d7bd0ac7ad472b94a13c4
Opcode Fuzzy Hash: 6ddc1dfdce584927db7e3029899622969a79c839d48a78b4ff4551ff10975383
Instruction Fuzzy Hash: CF218E307002048FDB08BBB894A45BE7AE6EFC8211B10487DD416DB395EF759E0687E2

Function 061BB358 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

4']q, xrefs: 061BB399

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 9c8b01e4e055f4437ec9d942a4b25f13c66ce6ecdf8cbb6a506697db3c0c284b
Instruction ID: 368b364effc2f46b82e2510198f5f28d9f5e7a765e1dd093c2d70f66c59a9a4b
Opcode Fuzzy Hash: 9c8b01e4e055f4437ec9d942a4b25f13c66ce6ecdf8cbb6a506697db3c0c284b
Instruction Fuzzy Hash: 3E01DF34E02289EFCB04EFB8E88989CBFF6FF85300B1115A9D84597261EB705E44CB51

Function 061B3EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4']q, xrefs: 061B3F25

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 576cc7c66d22464bb80a60d4926b74d7f1aad2a559069a4323ed3ca8292631c2
Instruction ID: 7f7cbef653465538a970faeacea5f754e0849f153d1bb6bb658807ca67e83635
Opcode Fuzzy Hash: 576cc7c66d22464bb80a60d4926b74d7f1aad2a559069a4323ed3ca8292631c2
Instruction Fuzzy Hash: 00F090313402018FC618EB29E99096E77EBDFC9250751496DD04A9B354EF64ED0A83A1

Function 061BB368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 061BB399

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 3ebccea8fba0b62ef385fe91594112fdbdaba80874568ad10cc02dc946540f87
Instruction ID: 8a596a7b850a8d51de1be3f1fe3a5e8ce0229a35c266f9087178078f69a9ab23
Opcode Fuzzy Hash: 3ebccea8fba0b62ef385fe91594112fdbdaba80874568ad10cc02dc946540f87
Instruction Fuzzy Hash: 1EF0AF30E02289EFCB04EFB8E58889CBBB7FF85200B1055A8D80697314DB706E04CB41

Function 061A3838 Relevance: 1.0, Instructions: 1033COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea09f8981970580fd6976701a467e9acb4db1925ef95544292857d47073daf86
Instruction ID: 7861f0c26847cf5c3caa931c63e447f878550ba08b6d53febb5d8b664a9f43a4
Opcode Fuzzy Hash: ea09f8981970580fd6976701a467e9acb4db1925ef95544292857d47073daf86
Instruction Fuzzy Hash: 19823834B402149FCB44CF69C994EAABBF6EF89700F15809AE506DB3A5CB71ED45CB60

Function 061A00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec0bb1b0d177f7f98443e5e7f8252fa5e95c87efc39bf0b185d47e641745e14
Instruction ID: d0ecd6bda41a22b22b31b5c44e6da127bd99b609754abf336bec599004a9d521
Opcode Fuzzy Hash: 2ec0bb1b0d177f7f98443e5e7f8252fa5e95c87efc39bf0b185d47e641745e14
Instruction Fuzzy Hash: A64278347406198FCB69EF78D954A6E7AA2FFC5308B01092CD5039B795CF79ED098B82

Function 061B48B8 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076f0042145ff43f2fd8d09bf3aaaf15d98eb0642af2c91433ff5ed22e367a1c
Instruction ID: 4329a11a4610d9cfc0da7416badae553230aacd1d5d7a4c25f4ef18aa0a9d846
Opcode Fuzzy Hash: 076f0042145ff43f2fd8d09bf3aaaf15d98eb0642af2c91433ff5ed22e367a1c
Instruction Fuzzy Hash: 2B324A34B006018FDB55DF39D588AAABBF6FF89304B1584A9E506CB3A6DB34EC45CB50

Function 061A0598 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe597670d68c922eaa4c3285e0eeee3340c47c455784bd5385be41f9d6e9231e
Instruction ID: b46a4e939d8914ec818ae247b48b6e6b2744a9544bbf05f047ccfdc450796ed4
Opcode Fuzzy Hash: fe597670d68c922eaa4c3285e0eeee3340c47c455784bd5385be41f9d6e9231e
Instruction Fuzzy Hash: E302AA34B403048FDB589F64D958A6E7BA2FFC9708F014958D9029B3A5CF79ED05CB92

Function 061A0610 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c748ee2110eb4e6545f8091304204615df032da51834bfa9b747980ba39a29b4
Instruction ID: 1a43a0ee04c2d7a840a6b39369a1d62698804c3e0713bfaa892e23665130fba1
Opcode Fuzzy Hash: c748ee2110eb4e6545f8091304204615df032da51834bfa9b747980ba39a29b4
Instruction Fuzzy Hash: C702AC38B403048FDB949B64C958A6E7BB6FFC9709F014859D9029B3A1CF79ED05CB92

Function 061A0688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459c52091b3900da6fe9ea1fed1f207e418d8a27e72c31ee1e7581808e46305f
Instruction ID: e0174c94abd96603733ad2cbebba8f8af2a5dd8620f3430f892ad614b25fed47
Opcode Fuzzy Hash: 459c52091b3900da6fe9ea1fed1f207e418d8a27e72c31ee1e7581808e46305f
Instruction Fuzzy Hash: 57E1CF38B403048FDB949B64C958A7A7BB2FFC9709F014859D9028B3A1CF79ED45CB92

Function 061A0700 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87926f5b2ee3950c7602a4f1686eee56a2adcd40d851cc1551b11a18f408510
Instruction ID: b4fc9b280b44b8bd0d053de1fe84aa194645184422f79f8cf3401318d1cd1d06
Opcode Fuzzy Hash: e87926f5b2ee3950c7602a4f1686eee56a2adcd40d851cc1551b11a18f408510
Instruction Fuzzy Hash: 7FD1C138B403048FDB849B64C958B7A7BB6FF89709F114459D9028B3A1CFB5ED45CB92

Function 061A00B7 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbe1ac795454d61f76589a85e36e4190fc4f2e98e9bdd8349d951f8c66f0012
Instruction ID: 5da72d5067c287131aec742bac15fb2c14956100266d7db377df4ca1ffabe774
Opcode Fuzzy Hash: 2fbe1ac795454d61f76589a85e36e4190fc4f2e98e9bdd8349d951f8c66f0012
Instruction Fuzzy Hash: 6BC1A138B403049FDB849B64C958B7A7BB6EF8D709F114459E9028B3A1CF75DD41CB92

Function 061B48A8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4a137443746e8e68c5e36816bac8eb3cafeef92ab08341ac799a826521ba4c
Instruction ID: 70005dbe347bfb39c1a00b7f0255391afab0ffd48364a7098f9506b61ecd7abd
Opcode Fuzzy Hash: 2a4a137443746e8e68c5e36816bac8eb3cafeef92ab08341ac799a826521ba4c
Instruction Fuzzy Hash: 97B13534B002048FDB45DF39D588AAABBF6FF88704B1584A8E546DB3A6DB30EC45CB50

Function 061B3F3F Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0709d83d5c710125361bd739120b7abe80446ad28585c2fd956f600d1caa6eb8
Instruction ID: 879513bc89f1642d41a7355a31f8e88940a75adbda2df47f3e09e0ed02b3003f
Opcode Fuzzy Hash: 0709d83d5c710125361bd739120b7abe80446ad28585c2fd956f600d1caa6eb8
Instruction Fuzzy Hash: 78617F34F002159FCB55DF79C984AAEBBF6BF88600B158169D905EB369DB70DC01CB90

Function 061B7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02136de15780b7786d770caa9bd24ba29c450fee43c315e5bd902019b87bbe64
Instruction ID: c45b54026347dd574e74ab3b4938e9c20095f6cb3249b55f60adc3aab1fca080
Opcode Fuzzy Hash: 02136de15780b7786d770caa9bd24ba29c450fee43c315e5bd902019b87bbe64
Instruction Fuzzy Hash: 23513871E00218CFDB55DFAAD881BDEFBF6AF88300F148429E415AB284DB749946CF91

Function 061A34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec574c3eb72521b8df9d50416de54a850772c37905cf22cbd000075bcca4144
Instruction ID: ee31e5335b71625bd4af4058a078b49a4122580c1160c7a10750e155b9afa91b
Opcode Fuzzy Hash: cec574c3eb72521b8df9d50416de54a850772c37905cf22cbd000075bcca4144
Instruction Fuzzy Hash: 8E514935B106199FCB44DF69C884A9EBBF2FF89310B158069E919EB361DB31ED05CB60

Function 061A3688 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514a844dc05d5f8ee57af92001d88a14c8187c97aaa9eb4b2fd52d4a28fa1a0c
Instruction ID: b7a7a0809bc8aea4c2648f18c5597782bf2c666d11adfac4a92bcc65d1b123ca
Opcode Fuzzy Hash: 514a844dc05d5f8ee57af92001d88a14c8187c97aaa9eb4b2fd52d4a28fa1a0c
Instruction Fuzzy Hash: 10514935B502149FCB44CF69C884AAEBBF6EF88310B158069E919EB365DB31EC05CB50

Function 061A3328 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6718bf2b9220529cf1e779a87e99602a3f1b3f9a6c64256f1892fd0b34f7a691
Instruction ID: dbe74f75b2fbfbe6e3cf3a338dd4c8c6f8350824cd59cfd71f12321b635f2ca5
Opcode Fuzzy Hash: 6718bf2b9220529cf1e779a87e99602a3f1b3f9a6c64256f1892fd0b34f7a691
Instruction Fuzzy Hash: B4514A35B506189FCB44CF69C884AAEBBF6FF88310B158469E915EB361DB31EC01CB50

Function 061B7D4C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2839d139b4e7838e8d0ef2f8a4db970eeb2583d150519308eb6840ee0b6b6d95
Instruction ID: e18133e3425547c5bb3b2af352b05c87f35879e3ba98e1ebe2aea8a280363dd9
Opcode Fuzzy Hash: 2839d139b4e7838e8d0ef2f8a4db970eeb2583d150519308eb6840ee0b6b6d95
Instruction Fuzzy Hash: 515148B0D00218DFDB55CFAAC885BDEBBF5AF88700F148429E419AB284DB749945CF91

Function 061B59C8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd270cbbc8435773420c0287ab64ec1b43dd25c02bf5d2fe94ee9847b15239f5
Instruction ID: 9f877c0b7b2042148c0487747b71e7080b8cc93d2041cf79391a7fd80c4ce913
Opcode Fuzzy Hash: fd270cbbc8435773420c0287ab64ec1b43dd25c02bf5d2fe94ee9847b15239f5
Instruction Fuzzy Hash: BE413435A00606CFCB54CF59C9809AABBF3FF89310B19C999E55AAB261D730F841CF94

Function 061B5579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6c92ddffc05d13840c0d67e1dd4ecdf582133974624488a4554d80a1028106
Instruction ID: 25f3ebd165dfdf07771b2cad40cbd81b4c7a27b93fb0d24f85eab23ab56c5a70
Opcode Fuzzy Hash: 9e6c92ddffc05d13840c0d67e1dd4ecdf582133974624488a4554d80a1028106
Instruction Fuzzy Hash: 74316B75B10210AFDB56DF38D8849AEBBB6FF89310B118469E905CB3A5DB30ED45CB90

Function 061A3817 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128414379.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f04e61729776731b5acff927ccaf78e3179b504988b10441739a638a628d7f
Instruction ID: 7a9329fc6f431608cf30146a8115804805acb71450996163a07834757a7e0696
Opcode Fuzzy Hash: 38f04e61729776731b5acff927ccaf78e3179b504988b10441739a638a628d7f
Instruction Fuzzy Hash: 2E319035745240AFC785CF68D898E6A7BF6EF8A710B15809AE516CF2A6CB32DC04C725

Function 061B5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81e5b95ffdfb3233a9474416f8994392026529cb6d904c1ab0c80fe62d49d38
Instruction ID: db519fe33eb7efb4afc12171b2df53ca459a6c8ed425a3f1b446dff3349561a7
Opcode Fuzzy Hash: e81e5b95ffdfb3233a9474416f8994392026529cb6d904c1ab0c80fe62d49d38
Instruction Fuzzy Hash: 1D318B75B102109FDB56DF38D8849AEBBB6FF89310B018469E805CB3A6DB30ED45CB90

Function 061B87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed97d311720f5097fc9c0a6dd51b2b3bec78b9b1cc9d58a80976b6d726be26a
Instruction ID: 1b5152f57d4d661b6607a2fbeea9ff6d5a724ca624177ac2d713db9029f035d0
Opcode Fuzzy Hash: aed97d311720f5097fc9c0a6dd51b2b3bec78b9b1cc9d58a80976b6d726be26a
Instruction Fuzzy Hash: 6041E2B1D01248DFDB54DFAAD940ADEFBBAAF88310F14802AE419B7254DB35A945CF90

Function 061B8796 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5078d1f9b85375ce700cf7e744a79a1d2c941f35ae7ae0541bf1c6cee02e31
Instruction ID: 1318a8ab8adb57685423f7e00342a21f4a9dbc879bb265b9bb9daf0e574c44e4
Opcode Fuzzy Hash: 2f5078d1f9b85375ce700cf7e744a79a1d2c941f35ae7ae0541bf1c6cee02e31
Instruction Fuzzy Hash: F931F2B1D01248DFDB54DFAAD984ADEBFFAAF88700F14802AE415B7250DB359945CF90

Function 061B8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922aa831d6a135e9c06bba2df8df863d3e46b2bca9964a78a6f93fc7ab4b3c84
Instruction ID: 6517f210478978a75b461a2181c6e725c5ee4d536ccf5b83453f034dfac1efdf
Opcode Fuzzy Hash: 922aa831d6a135e9c06bba2df8df863d3e46b2bca9964a78a6f93fc7ab4b3c84
Instruction Fuzzy Hash: DB3111B1D01218DFDB54DFA9D990ADEFBF9AF48310F24842AE409B7240CB34A945CB90

Function 00CED1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119518045.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14dd6bd1ae151c3ee6c52f071a78bab0edbb78255fb2dfeae5fa3284e39b8538
Instruction ID: 76de2683c74aae881d9cd7cb796d307b6ee6bd39816e64e009512dd3eb64f206
Opcode Fuzzy Hash: 14dd6bd1ae151c3ee6c52f071a78bab0edbb78255fb2dfeae5fa3284e39b8538
Instruction Fuzzy Hash: F121D372504284DFDB05DF55D9C4B26BF65FB88310F24C5A9EA0A0B256C33ADC16DBA1

Function 00CED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119518045.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3cc99f7c8926c378611fd517c118e961049f82c704798bf71f3814d93e7fd8
Instruction ID: 81457632832227743bb49e9255a01384e7bb3073d6fc2f598c6451e41ace2aa1
Opcode Fuzzy Hash: 1d3cc99f7c8926c378611fd517c118e961049f82c704798bf71f3814d93e7fd8
Instruction Fuzzy Hash: CB2134B2500280DFCB05DF15D9C0F26BF65FB98318F20C569E90A0B256C33AD956DBA2

Function 00CFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119629077.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2c9e68eb12ba41520ef216ac5002ba5c91ba544ad45fadcf97e10c71753e95
Instruction ID: 5b71f54cca3e23fd2e5f07406ed02e233e539fb26a71d066e27f9c6ca5ab5cb3
Opcode Fuzzy Hash: 6a2c9e68eb12ba41520ef216ac5002ba5c91ba544ad45fadcf97e10c71753e95
Instruction Fuzzy Hash: 7E21F571504208DFDB55DF24D5C4B26BF66FB84314F20C569EA0A4B356CB3AD807CA62

Function 061B8A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5865ab1b3cf7446ca620b34c88895ebba4b8da1e8c68054dd98da8cd6d698c
Instruction ID: 0fcc773139ee53473f6d23b2a1bffbf76e608b701ff57b763896f33377c3676b
Opcode Fuzzy Hash: ed5865ab1b3cf7446ca620b34c88895ebba4b8da1e8c68054dd98da8cd6d698c
Instruction Fuzzy Hash: 6C2122B1D10248DFDB54DFA9C995BDEBBF9AF08700F14842AE009B7240DB34A946CBA0

Function 00CFD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119629077.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be14a9a988592007813f5a3a054edc5f29ecd3ee888761a98111c72555162bd
Instruction ID: 146c47088fce86b0e95f2e20af55fa965060efabea3311f67c12972d007fc117
Opcode Fuzzy Hash: 8be14a9a988592007813f5a3a054edc5f29ecd3ee888761a98111c72555162bd
Instruction Fuzzy Hash: 1F218E755093848FCB03CF24D994715BF72EB46314F28C5EAD9498B2A7C33A980ACB62

Function 00CED1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119518045.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 1e0ced098fcecb9d8041358fa5e32d4b265fecae1ff2e25277f76284f4c613cf
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: FA21B176504280DFDB06CF50D9C4B16BF72FB88314F24C5A9DD490B656C33AD92ADBA2

Function 00CED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119518045.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 49cf41469db1e9cea6a738d0cbd7b2256aa2dfc73580a1d7b602531e9e3d3eed
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 9511E6B6504280CFCB16CF14D9C4B16BF71FB98314F24C6A9D94A0B656C33AD95ACBA2

Function 061BBC5F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e27d6284f6979f217ac540ff54f36a7c1e3c58a6733262d77849bda21470ce4
Instruction ID: 2baace505d2b9e41187a30d55f0c3a5994bb661f915ec998e9d3bbba6959b4ce
Opcode Fuzzy Hash: 3e27d6284f6979f217ac540ff54f36a7c1e3c58a6733262d77849bda21470ce4
Instruction Fuzzy Hash: A2110E316002414FC398EF35F95992E7BEBEFC6200B15182CE1428B660DE30BA4ACB91

Function 061B8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d6870ed1807e35f5ea19284eefc2c0a948e05311136d03c970a911dbb30818
Instruction ID: 66098309fcfc3af7fdf8f6e9ed660aa2f752347379b29daab3a65392864c6cad
Opcode Fuzzy Hash: c9d6870ed1807e35f5ea19284eefc2c0a948e05311136d03c970a911dbb30818
Instruction Fuzzy Hash: C701D431B101099FDF10DEA9EC45ABFBBBEEBC4651B14403AF504D3240EB71A91587A0

Function 061BBC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cac884acf3bc82a9f3df9db234cd744b024f2a5d7c7c5d923c652c8fd092e1
Instruction ID: 3d37ac1bd99d55d4d05c1e5521539d4ae4556d1c090b8dc9e6ee641d38440e6b
Opcode Fuzzy Hash: e8cac884acf3bc82a9f3df9db234cd744b024f2a5d7c7c5d923c652c8fd092e1
Instruction Fuzzy Hash: 2201B831A002414B87D8AF79F95893E3AABEFC5254F554828E2078B664DE34BE4A8791

Function 00CEDB09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119518045.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecea5df4520d8a6e945ab9beff1b05c902210151250cd61bc2718cbefbbe338
Instruction ID: 6264586be64937467ff35661068c921b41e50b34e36b53784d92c0b268e98c7f
Opcode Fuzzy Hash: 5ecea5df4520d8a6e945ab9beff1b05c902210151250cd61bc2718cbefbbe338
Instruction Fuzzy Hash: 6C012631004380DBEB208B1BCC84B67FF9CEF85320F18C42AED1A0B286E2799940CA75

Function 061B5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656067eff7a666f297986e40a7c755a00416dfe984ad99a2f2ffc9d84bb426b0
Instruction ID: ef19c46416ec9902521b4b1fa15e7ee2ca54cc424f1b0c3b19c5fac2fcb9eee9
Opcode Fuzzy Hash: 656067eff7a666f297986e40a7c755a00416dfe984ad99a2f2ffc9d84bb426b0
Instruction Fuzzy Hash: 1C01D630A11701CFDBA98F39A5445A777F7BF84206B14983CE00382559DBB5E480CB94

Function 061B6E90 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649c73e485f0204dded983cc22c88e0cc7d074dc6099127d9995a7dd67051bf3
Instruction ID: f404726cc4fb3e095756cce36078b883766af3a419769a1f0f250e8362bf5365
Opcode Fuzzy Hash: 649c73e485f0204dded983cc22c88e0cc7d074dc6099127d9995a7dd67051bf3
Instruction Fuzzy Hash: 5BF096772041D83FDB518EAA9C11EFB3FEDDB8D161F084156FAA9C2241D439C961A7B0

Function 061BE8B0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a967930aa383d4250b6a2a973e7a19e0f6f529a5e88844fd9a5445a60f3db64
Instruction ID: 4864317a06ae07ac4967ef39a2ebc93f80b30d3ae76ed051f5783f96d8bf4941
Opcode Fuzzy Hash: 5a967930aa383d4250b6a2a973e7a19e0f6f529a5e88844fd9a5445a60f3db64
Instruction Fuzzy Hash: 4E01F2306083489FCB02EF78D8508997FBAEF8620071448EEE540CB262DB36DD02CB81

Function 061B8F42 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2125bc84fcca7a9d0b4f6b9744f8c4a749f2bfc2e6db9d19e7e52c9e9fbed926
Instruction ID: cac96abb724be60ef1815f16086b9a75d3b456215abbaefa79e65d3a760f3a8e
Opcode Fuzzy Hash: 2125bc84fcca7a9d0b4f6b9744f8c4a749f2bfc2e6db9d19e7e52c9e9fbed926
Instruction Fuzzy Hash: 8601E2B8D04209DFDB44DFA8E944BEEBBB4FB48301F1055A9E815A3340E7345A40DF90

Function 061B8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8af2de14f1b22c29537f26860684fbb5cb569ee5ec4e1b60ac73c4706207070
Instruction ID: 44ae9324157b70bcdd5e94be636ddd491fdfca753d48b13ed0303a18edd85972
Opcode Fuzzy Hash: b8af2de14f1b22c29537f26860684fbb5cb569ee5ec4e1b60ac73c4706207070
Instruction Fuzzy Hash: 6001AEB4D0420AEFDB84DFA9D9446EEBBF5AB48301F1094AAE815A3250E7744A40DF91

Function 00CEDB08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119518045.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5dafc5dfc55135ee3c93329f8583ddf7b438a49b35b2416131adf889b1c883
Instruction ID: e6caf7d3b32235a924862578599cc30eccb726a463081c7f5f6da2fa5a62699a
Opcode Fuzzy Hash: de5dafc5dfc55135ee3c93329f8583ddf7b438a49b35b2416131adf889b1c883
Instruction Fuzzy Hash: BEF0CD71004384AFEB208A0ACC84B66FFA8EF91724F18C45AFD194B286D2799940CAB5

Function 061BC170 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1de322ef6f0113e26042a9f4a73bbdc1093f8b2885a41a59aa352824febd201
Instruction ID: d1c8324f2724762f186d5d7388b1cc779e778c1fff4c085190cc09884e05e01b
Opcode Fuzzy Hash: c1de322ef6f0113e26042a9f4a73bbdc1093f8b2885a41a59aa352824febd201
Instruction Fuzzy Hash: 22018B75805B02DFD325DF61E498512FBFAFF89300710861ED48683A60DB70A545CF90

Function 061B6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1849bd8f103b48f334126c0b50c3e6f837431af1e5c95c6597795d0f131d18bc
Instruction ID: ec46b42d56326d685a32826f95157078af32b35c863d7194ece595b8750c8a92
Opcode Fuzzy Hash: 1849bd8f103b48f334126c0b50c3e6f837431af1e5c95c6597795d0f131d18bc
Instruction Fuzzy Hash: FDF012662041E83F8B528EAA5C14CFB7FEDDA8E161B094156FEA8D2141C42DCD61ABB0

Function 061BACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4fee4ec376989ae902b9f436c33ac7f6228c79af5d64e1c2e14d606335c127
Instruction ID: e14d5eefe0a99dd2157427b81bf448185cc848cf4f1899cca5a2059f51f2f9d7
Opcode Fuzzy Hash: 8b4fee4ec376989ae902b9f436c33ac7f6228c79af5d64e1c2e14d606335c127
Instruction Fuzzy Hash: AFF09E723081A15FC3261B75AC584BD3FEADEC675170804DFD182C7251CB585506C7E1

Function 061BADE9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ecee9203dfebf0f9d11ba73a6994837740cda46cdcb59e42ac8efe1d1160db
Instruction ID: b8dbe9375fa2eb12be83886c3481f6dc9e06e1e40f15eff9ea54d43a6e63b42f
Opcode Fuzzy Hash: d2ecee9203dfebf0f9d11ba73a6994837740cda46cdcb59e42ac8efe1d1160db
Instruction Fuzzy Hash: CCF0E9312042819FC3109FA9F498B9ABFFAEFCA314B14046EE149C7253CA7568098775

Function 061B67C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239ff394feacd317361a0d05f6eacc0ca9532721aa4304be2795abbb0704dc47
Instruction ID: a510057214b4f2191a9ff6eefe78e1910313054ba664e465011dd07c833a627b
Opcode Fuzzy Hash: 239ff394feacd317361a0d05f6eacc0ca9532721aa4304be2795abbb0704dc47
Instruction Fuzzy Hash: 55F09031B50300AFD7218A68E841F957FE9EF96721F158266F214CB1E2D7B1E849D780

Function 061B8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e945bed462f4e44e6e894e3f32fe2f377b9ee128bee75ff9a0b20f50c09e3aa4
Instruction ID: ad539e48d63ed17c266c8c14542f2d71fbdfec6a10d52056a8545b6ac540fa2d
Opcode Fuzzy Hash: e945bed462f4e44e6e894e3f32fe2f377b9ee128bee75ff9a0b20f50c09e3aa4
Instruction Fuzzy Hash: 14F0A9B4C08159DFDB80CFA0D8444EDBFB4EB6A301F0055DAE402E7350E7394A01DB40

Function 061B8341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e194f2e1138b1ec30291145751e698773d357000df115feda18045ba4562f67
Instruction ID: 3fb20ecfaa1db6f16975d05cfe2f34aa73d5c01554b7c8f6bd98a6b9a74798ea
Opcode Fuzzy Hash: 4e194f2e1138b1ec30291145751e698773d357000df115feda18045ba4562f67
Instruction Fuzzy Hash: C4F0A032F241195B9F50DAA9AC849EFBFBDEB99661B080036E914C3140EB31D80587A1

Function 061BC110 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a5a0188b5294eede7ae66d9cf557eebee31d39be078d11a85564095d067049
Instruction ID: c9d864e902eb892dfa6e7a97821b5709fead62dac05186575c79939ae465249d
Opcode Fuzzy Hash: 21a5a0188b5294eede7ae66d9cf557eebee31d39be078d11a85564095d067049
Instruction Fuzzy Hash: 86F0F6315097D15FC316DB28F51969ABFEBDF86314B04085ED182CB293D7B0A905C751

Function 061B54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c333f31c17ea088fcb95f9d6c98ccb6b65daa33c4d826d99dfdbd5414419e931
Instruction ID: 716bc972b2daa746b1a15a4e69225c50365d3b6e378554b4816ce4b2dfb00745
Opcode Fuzzy Hash: c333f31c17ea088fcb95f9d6c98ccb6b65daa33c4d826d99dfdbd5414419e931
Instruction Fuzzy Hash: 6BF0B4315007428FEBA9CF21E9407A77BB3AF80316F08986DE04246A69D775E6C5CB80

Function 061BAC60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ae706ac95fc41864dce03d45a71160cbc96a34946de41b0cfa8008247c0e84
Instruction ID: 9ef923e3e7151dcde9c7d181b11dd2c69b2d802b7b8476a7521f1c94ceb1e32c
Opcode Fuzzy Hash: 73ae706ac95fc41864dce03d45a71160cbc96a34946de41b0cfa8008247c0e84
Instruction Fuzzy Hash: 27F027322086E55FC3235B39A8384ED3FABDFC622070800DBD181C7253CE580A49CBE5

Function 061BADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793661876dc056821f85cb3c61095dd47a56a920dff99138c7ae51d1f48855fd
Instruction ID: 5717342689bbda14c7f0d18cbd1b23c17c039f90d1521d9823844f58f9e429d2
Opcode Fuzzy Hash: 793661876dc056821f85cb3c61095dd47a56a920dff99138c7ae51d1f48855fd
Instruction Fuzzy Hash: 63E092312005516BC3546E9AB448AAE7AEFEBC9351B00403CF20EC3242CAB2680587A5

Function 061BC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1319cd0704c47761a55fc684b6da2940e60ccb3944576c50c74b196d6d8837
Instruction ID: f88b93baca9cb819ff25b1e780b6324cd51b43c1d2361a43cd05f7832856bdeb
Opcode Fuzzy Hash: ae1319cd0704c47761a55fc684b6da2940e60ccb3944576c50c74b196d6d8837
Instruction Fuzzy Hash: 5CF06D34901B01CFD725DF66E448522FBF7FB88301700862AE54B82A10DB70A50ACFD4

Function 061BB500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d291394d832de0f11a3ffd038d1a3bc166b7c193a3c1516619628c1f3dec85
Instruction ID: 9532c24d11c9ee71da9d690a54ae7a6475356a02a369ec4e9442c76ff8bd98ab
Opcode Fuzzy Hash: 95d291394d832de0f11a3ffd038d1a3bc166b7c193a3c1516619628c1f3dec85
Instruction Fuzzy Hash: 7AF01535D0120CEFCB01DFB4DA488CDFBBAEB44200F1042A6A905E2244EA305B858B91

Function 061BC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edea06c381ce03693478a073d8a26c5e74666affcbb0668b8962ae77a867a24b
Instruction ID: 90ca03ff5d3e7245bc16a5416368f66add06974ea5fc10589631b114a779d0cb
Opcode Fuzzy Hash: edea06c381ce03693478a073d8a26c5e74666affcbb0668b8962ae77a867a24b
Instruction Fuzzy Hash: F8E0E5306007904FC311EB2DE508BAEBBEBDFC6314F04042DE246CB642CBB5A8058791

Function 061B5698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5099538e6590976c257c16ae47bb40d50fb1c8e55cab6d8aaf640037f26e8bd8
Instruction ID: 512986f95a9e8377c72d10af2670249c7aa5be257423c50172d5b4d12b88c077
Opcode Fuzzy Hash: 5099538e6590976c257c16ae47bb40d50fb1c8e55cab6d8aaf640037f26e8bd8
Instruction Fuzzy Hash: 79E012B250C2519FE345DB34E8548967BA4EBA5311B158CAEE48087191E732D885C7A9

Function 061BCE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52935245a03ba052be6309966f113301b95e03a6f1a1cf73ee30d563eed8ce2
Instruction ID: b2981777ab2e63a77b3b546d45670f56882fdeac66bb6df722cf5705ffe555ec
Opcode Fuzzy Hash: e52935245a03ba052be6309966f113301b95e03a6f1a1cf73ee30d563eed8ce2
Instruction Fuzzy Hash: 13E0C630000382EFC302EF20F202D883FE6EB82320B02100CE8809F249CB74AD42C793

Function 061BE280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67861d0e4ee392d2b04db8bc8e2cecd5275954c6ca75b1fd8cbb5c549e5e4c7a
Instruction ID: aed2b8528fd3485fea2a967a6cdb6bf545df96ea35632867be5017f84655de77
Opcode Fuzzy Hash: 67861d0e4ee392d2b04db8bc8e2cecd5275954c6ca75b1fd8cbb5c549e5e4c7a
Instruction Fuzzy Hash: 61E020304057805FCB01FB20FC559D53765E785700B035049D8006F2AAC7741F4AD7D1

Function 061BE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2353300081177c5ffff2499589ec6737ebf406cc56d853b125ea09f22242849e
Instruction ID: 49a6576a1cfcfc7b5a211f66d78b4c712de7818e62a4edcf856475276763bac0
Opcode Fuzzy Hash: 2353300081177c5ffff2499589ec6737ebf406cc56d853b125ea09f22242849e
Instruction Fuzzy Hash: E5E0DF71E45284EFCB01CF64E8009AE3BB6DB82300B2045DAE809EB291D6314F158B52

Function 061BCC38 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef5a0c1c49147268a43cd16e75e6236fbda08402564c6af3e75104544aaf334
Instruction ID: 366457cc28727b62de6940e7c40208aaeaf46bda216a74bb6c2029401e7c7ea9
Opcode Fuzzy Hash: 4ef5a0c1c49147268a43cd16e75e6236fbda08402564c6af3e75104544aaf334
Instruction Fuzzy Hash: 49E026326016808FC702EF25F8409DC7BA6FB82710B12511AD040EF76ACB301D86CBD2

Function 061BAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623df6e4bbbf0d5409df8ff6e4df47d62707c95f4db9dd81ee0959d2fe44d6f9
Instruction ID: 24448cca1ec135100c0ea3bce213991c1ec7389cbdd39e06665a1783660088de
Opcode Fuzzy Hash: 623df6e4bbbf0d5409df8ff6e4df47d62707c95f4db9dd81ee0959d2fe44d6f9
Instruction Fuzzy Hash: FED02B31300826578715276AB40C4BE379FEBC47717000129E207C3300CE641D0587D5

Function 061BB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752020d4c8fd3143b42f97f6a7688ec5a38fa87d24b520527f41c337f95f8eac
Instruction ID: 5e5eb33ccef2be1c1afeec7bc13ac4451ce799a0ef6746ac75bcef94889a245c
Opcode Fuzzy Hash: 752020d4c8fd3143b42f97f6a7688ec5a38fa87d24b520527f41c337f95f8eac
Instruction Fuzzy Hash: 6FE09275E0120CEFCB40DFE5E9448DDFBBAEB48200F1082AAD909A3200EB706B55DF80

Function 061BF8E2 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d86a4001d4691a77b63806d5f48ea2d128f21ba0bb0aadc8d76df7c568478a
Instruction ID: 447ae3be420553e203ff0b334e9e13b04ab120c4e3efc5d65cf64f887a544f66
Opcode Fuzzy Hash: 48d86a4001d4691a77b63806d5f48ea2d128f21ba0bb0aadc8d76df7c568478a
Instruction Fuzzy Hash: 3FD02B32B081911BC3118A5CB4044297BE6DBC6301306005FE446C3241CA2058008351

Function 061BE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f48fbb599205ad8aaa35374b1cc8518a4d5e99875c05f74e4f74433c43641b4
Instruction ID: 7b027eaf44f657483c01fc20a1ea819070e8452e666ccff1809c4bd7941762e4
Opcode Fuzzy Hash: 0f48fbb599205ad8aaa35374b1cc8518a4d5e99875c05f74e4f74433c43641b4
Instruction Fuzzy Hash: 13D05E71E0124CFFCB40EFA8F90195DB7BAEF85204B2041A9D409E7300EA316F009B91

Function 061BE8F8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1cabc3fe6cd2e9466767458ebdc47414ab05ee1e1cde1526394f3eb8bd9679
Instruction ID: c4a450a7e6ef33bb96ec31d649cb7d62857a25c53127669226bb1bf3c467c072
Opcode Fuzzy Hash: ee1cabc3fe6cd2e9466767458ebdc47414ab05ee1e1cde1526394f3eb8bd9679
Instruction Fuzzy Hash: F8E0173A219348AFC701DF68D885C55BBF9BF4A700715549EE9C48F672C772A910DF21

Function 061BDFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b02248ace280e161f54d1e85d99b618d0cda329dd60571cf125253fe8d77a38
Instruction ID: 4932949a7851ff513c3cc9a98d6556cbe7db4536f967fa8b1d8ca8e82a6af751
Opcode Fuzzy Hash: 4b02248ace280e161f54d1e85d99b618d0cda329dd60571cf125253fe8d77a38
Instruction Fuzzy Hash: 42C04C7158BA949ADB0217248D098813E276B52B1071510C6A741C90679611040586A1

Function 061B3721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fad5d6a2a9b4c8b7e72c2dd679d7ad365eb1b353010ecbbe04b680632f707b
Instruction ID: 172a04a1f2dc5ad5cffede7c4f65f617aa0ff9498986e26233e76a4218f86217
Opcode Fuzzy Hash: 42fad5d6a2a9b4c8b7e72c2dd679d7ad365eb1b353010ecbbe04b680632f707b
Instruction Fuzzy Hash: 54C0923AA201415BE7029BB4B90AFA13FA1E7A8F01F060500E38246093E6A5448ACBA6

Non-executed Functions

Function 061B6FE8 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37310408f181ff3b3b2320c08121d9bd5b6393f57f31bd76e541e33a95fe76a8
Instruction ID: e47c25c028a6290157c3086743c4ba72bbdde2f012d03b9eedacbd8c2cab204f
Opcode Fuzzy Hash: 37310408f181ff3b3b2320c08121d9bd5b6393f57f31bd76e541e33a95fe76a8
Instruction Fuzzy Hash: 876252B06002009FD749DF19D55876ABAEAEF85308F64C85CD00D9F396CBBBD90B8B95

Function 061B6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d12017574d7141834e279076a94f36368460eb798a37ead389839bef039628
Instruction ID: 3d48b3c9372db41eea9e46a1b843916f805236c98b94ff8775ea431410613f80
Opcode Fuzzy Hash: d2d12017574d7141834e279076a94f36368460eb798a37ead389839bef039628
Instruction Fuzzy Hash: AF6252B06002009FD749DF19D55876ABAEAEF85308F64C85CD00D9F396CBBBD90B8B95

Function 00F8DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ebe45d09b91e68b0075cb874e72de5406b8d05cbfd2de660c15da456fafc13
Instruction ID: bb2b91d896d9823df3f598ae3d83179786d82440e6515a95b82f3015257dfa7e
Opcode Fuzzy Hash: f7ebe45d09b91e68b0075cb874e72de5406b8d05cbfd2de660c15da456fafc13
Instruction Fuzzy Hash: 32A19D36E006198FCF19EFB4C8409DEB7B2FF85310B24857AE805AB265DB75E945DB80

Function 00F825D8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2120016970.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd19d2eb311d28092b811755ae25dd0fc1380523ca1d031b4753b6a3b51dbc9
Instruction ID: b400104fa5f5f45070437051f272612f2bca555cc1a2eed2b5b12588202c405a
Opcode Fuzzy Hash: 3cd19d2eb311d28092b811755ae25dd0fc1380523ca1d031b4753b6a3b51dbc9
Instruction Fuzzy Hash: B2213067A4DAE85BC703963D4C701D6BBA0EC1702C70953C3D1A89D5E7E585809BD29F

Function 061BED10 Relevance: 7.9, Strings: 6, Instructions: 379COMMON

Download Yara Rule

Strings

(_]q, xrefs: 061BEF79
(_]q, xrefs: 061BEDF9
(_]q, xrefs: 061BF0F9
(_]q, xrefs: 061BF07A
(_]q, xrefs: 061BED7A
(_]q, xrefs: 061BEEFA

Memory Dump Source

Source File: 00000000.00000002.2128431158.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q$(_]q$(_]q
API String ID: 0-414434136
Opcode ID: b91ac661c4237f38ac4e7a430e1e9cc93555c902296ed6202e9e163d1b24fb4b
Instruction ID: e36e39559d70749c432d95f60def211e8534b25225028c8b5ecd58b2d8fdc0ee
Opcode Fuzzy Hash: b91ac661c4237f38ac4e7a430e1e9cc93555c902296ed6202e9e163d1b24fb4b
Instruction Fuzzy Hash: DCE19D35A043449FCB05AF68C4645AE7FB2EFC6310B2484AEE946DB381DB35DE06CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe.log

C:\Users\user\AppData\Local\Temp\Tmp63A5.tmp

C:\Users\user\AppData\Local\Temp\Tmp63B6.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955_dump.exe

Function 061B3F50 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Function 061A0D80 Relevance: 20.6, Strings: 16, Instructions: 625
COMMON

Function 061A1582 Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Function 00F8AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 00F85935 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 00F84248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00F8C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00F8D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 00F8A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00F8B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00F8B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 061B59D8 Relevance: 1.5, Strings: 1, Instructions: 291
COMMON

Function 061A1BA0 Relevance: 1.5, Instructions: 1456
COMMON