Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1482539
MD5:	a9a37926c6d3ab63e00b12760fae1e73
SHA1:	944d6044e111bbad742d06852c3ed2945dc9e051
SHA256:	27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
Tags:	exe
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3956 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A9A37926C6D3AB63E00B12760FAE1E73)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.215.113.67:40960"], "Bot Id": "25072023", "Authorization Header": "ddfd60e2a31e5ba38817ce280e48c5bb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.1284557443.0000000000102000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3956	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.0.file.exe.100000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:41.369324+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:40.469456+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:44.633276+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:46.543269+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:43.619800+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:41.083135+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:44.974829+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:43.139769+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.11

Timestamp:	2024-07-26T01:04:51.050265+0200
SID:	2022930
Source Port:	443
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.11

Timestamp:	2024-07-26T01:05:29.373404+0200
SID:	2022930
Source Port:	443
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:40.215517+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 185.215.113.67 - Destination IP: 192.168.2.11

Timestamp:	2024-07-26T01:04:34.607725+0200
SID:	2043234
Source Port:	40960
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:40.746049+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:46.794068+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:42.641660+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:42.092703+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:44.376979+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:47.090174+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:42.889746+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:47.382492+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:34.357258+0200
SID:	2046045
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:45.344635+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:39.656148+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:43.871833+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:42.389735+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 185.215.113.67 - Destination IP: 192.168.2.11

Timestamp:	2024-07-26T01:04:39.912452+0200
SID:	2046056
Source Port:	40960
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:45.351191+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.11 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T01:04:44.126664+0200
SID:	2043231
Source Port:	49703
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: file.exe

Malware Configuration Extractor: RedLine {"C2 url": ["185.215.113.67:40960"], "Bot Id": "25072023", "Authorization Header": "ddfd60e2a31e5ba38817ce280e48c5bb"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 07220538h	5_2_07220040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_0722F9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 0722F85Dh	5_2_0722F483
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 0722F85Dh	5_2_0722F490

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.215.113.67:40960

Source: global traffic

TCP traffic: 192.168.2.11:49703 -> 185.215.113.67:40960

Source: Joe Sandbox View	IP Address: 185.215.113.67 185.215.113.67
Source: Joe Sandbox View	IP Address: 185.215.113.67 185.215.113.67

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.67

Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: file.exe, 00000005.00000002.1536654966.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9&
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: file.exe, 00000005.00000002.1537465544.000000000255C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.0000000002734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000024E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.000000000278C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.000000000278C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.000000000278C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: file.exe, 00000005.00000002.1537465544.000000000255C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: file.exe, 00000005.00000002.1537465544.000000000255C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: file.exe, 00000005.00000002.1537465544.0000000002788000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: file.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp49EB.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp49EC.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_048DDC74	5_2_048DDC74
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D467D8	5_2_05D467D8
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D4A3E8	5_2_05D4A3E8
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D4A3D8	5_2_05D4A3D8
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D46FF8	5_2_05D46FF8
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D46FE8	5_2_05D46FE8
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722B380	5_2_0722B380
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_07220040	5_2_07220040
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722EF78	5_2_0722EF78
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_07222D18	5_2_07222D18
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_07221BD0	5_2_07221BD0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_07227A28	5_2_07227A28
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722F9F0	5_2_0722F9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722B828	5_2_0722B828
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722F483	5_2_0722F483
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722F490	5_2_0722F490
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722F9E0	5_2_0722F9E0

Source: file.exe, 00000005.00000002.1536758228.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000005.00000000.1284583506.0000000000146000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameBaling.exe8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameBaling.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@1/5@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp49EB.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.5.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe

Static PE information: 0xBD051842 [Sun Jun 29 00:35:14 2070 UTC]

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D31DAF push FFFFFF8Bh; retf	5_2_05D31DB1
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D4C710 push es; ret	5_2_05D4C720
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D4E060 push es; ret	5_2_05D4E070
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_05D4ECF2 push eax; ret	5_2_05D4ED01
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722B28C push FFFFFF8Bh; iretd	5_2_0722B28E
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_0722B2E0 push FFFFFF8Bh; iretd	5_2_0722B2E2

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\file.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 23A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 23F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 43F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 496	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7064	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: file.exe, 00000005.00000002.1546112643.0000000006165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~~
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: file.exe, 00000005.00000002.1539163940.0000000003780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: file.exe, 00000005.00000002.1539163940.00000000034F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000005.00000002.1536758228.00000000007D5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 5.0.file.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1284557443.0000000000102000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3956, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR_qD9
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR_q
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR_q\D
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR_q
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q%appdata%`,_qdC:\Users\user\AppData\Roaming`,_qdC:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR_q\D
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q&%localappdata%\Coinomi\Coinomi\walletsLR_q
Source: file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3956, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 5.0.file.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1284557443.0000000000102000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3956, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://purl.oen	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	file.exe, 00000005.00000002.1537465544.000000000255C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	file.exe, 00000005.00000002.1537465544.0000000002788000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://purl.oen	file.exe, 00000005.00000002.1536654966.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	file.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	file.exe, 00000005.00000002.1537465544.000000000255C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000024E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.0000000002734000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.000000000278C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	file.exe, 00000005.00000002.1537465544.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	file.exe, 00000005.00000002.1537465544.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	file.exe, 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.67	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482539
Start date and time:	2024-07-26 01:03:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@1/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 91 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.67	oMHveSc3hh.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	0KuDEDABFO.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	miOnrvnXK0.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	Rh74sODsWE.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	dSQUdo6EjO.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	usVhwck8lN.exe	Get hash	malicious	Amadey Raccoon	Browse	185.215.113.67/4dcYcWsw3/index.php
	SecuriteInfo.com.W32.AIDetect.malware1.20102.exe	Get hash	malicious	Amadey	Browse	185.215.113.67/4dcYcWsw3/index.php
	MR98F1zzeo.exe	Get hash	malicious	Amadey Raccoon Vidar	Browse	185.215.113.67/4dcYcWsw3/index.php
	8f5718a6042061b23a4e42ee5cd8112946c135dc9d0c2.exe	Get hash	malicious	Amadey	Browse	185.215.113.67/4dcYcWsw3/index.php
	fC4T1vVs24.exe	Get hash	malicious	Amadey	Browse	umbrelladownload.uno/gp6GbqVce/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	LisectAVT_2403002A_22.exe	Get hash	malicious	Amadey	Browse	185.215.113.32
	LisectAVT_2403002A_338.exe	Get hash	malicious	Amadey	Browse	185.215.113.32
	LisectAVT_2403002B_222.exe	Get hash	malicious	Amadey, Bdaejec	Browse	185.215.113.32
	LisectAVT_2403002B_259.exe	Get hash	malicious	Amadey	Browse	185.215.113.32
	LisectAVT_2403002B_29.exe	Get hash	malicious	Amadey, Bdaejec	Browse	185.215.113.32
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	185.215.113.66
	LisectAVT_2403002B_53.exe	Get hash	malicious	Amadey	Browse	185.215.113.32
	LisectAVT_2403002B_77.exe	Get hash	malicious	Amadey	Browse	185.215.113.32
	Lisect_AVT_24003_G1A_79.exe	Get hash	malicious	Amadey, Bdaejec	Browse	185.215.113.32

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 10:09:14 2023, atime=Mon Oct 2 20:46:56 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.465084577299074
Encrypted:	false
SSDEEP:	48:8Sqd4TUCr5RYrnvPdAKRkdAGdAKRFdAKRN:8S9i
MD5:	0204FCA7A946694CB22DEA259D5BC269
SHA1:	427BDD8E24B2856DA8A27B5A704B3A5B3AC0EFE3
SHA-256:	4298DD0E2B6A424528CDBE16972FA32BBCB0E41CA0D8A9F691B7F15B0A59EB66
SHA-512:	FF3B6C5A9A1DE8B2AC1A39FB3CFDA3A6E28883E5F1EAD1CEC30215B07F0818C09427F2839167A3AAF1DE6504BDACAF6591969908C6FF1C633E63A643744EE81E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.......`\|...>'..y... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.IEW.Y....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEWgV....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.VEW.V....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.VEW.V..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.BW. .chrome.exe..F......CW.VEW.Y.............................c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp49EB.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp49EC.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.081927371705491
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	file.exe
File size:	311'296 bytes
MD5:	a9a37926c6d3ab63e00b12760fae1e73
SHA1:	944d6044e111bbad742d06852c3ed2945dc9e051
SHA256:	27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512:	575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97
SSDEEP:	3072:aq6EgY6iQrUjGk14lwPK4qw9LwwPITAztASKwlcZqf7D34leqiOLibBOh:ZqY6iwwPIknATAZA+lcZqf7DIvL
TLSH:	96646C1867EC8911E27F4B799471D2749375EC56A512E30F4EC06CAB3E32741FA21AB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.................0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x42b9c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBD051842 [Sun Jun 29 00:35:14 2070 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
popad
add byte ptr [ebp+00h], dh
je 00007F8528D7D732h
outsd
add byte ptr [esi+00h], ah
imul eax, dword ptr [eax], 006C006Ch
xor eax, 59007400h
add byte ptr [edi+00h], dl
push edx
add byte ptr [ecx+00h], dh
popad
add byte ptr [edi+00h], dl
push esi
add byte ptr [edi+00h], ch
popad
add byte ptr [ebp+00h], ch
push 61006800h
add byte ptr [ebp+00h], ch
dec edx
add byte ptr [eax], bh
add byte ptr [edi+00h], dl
push edi
add byte ptr [ecx], bh
add byte ptr [ecx+00h], bh
bound eax, dword ptr [eax]
xor al, byte ptr [eax]
insb
add byte ptr [eax+00h], bl
pop ecx
add byte ptr [edi+00h], dl
js 00007F8528D7D732h
jnc 00007F8528D7D732h
pop edx
add byte ptr [eax+00h], bl
push ecx
add byte ptr [ebx+00h], cl
popad
add byte ptr [edi+00h], dl
dec edx
add byte ptr [ebp+00h], dh
pop edx
add byte ptr [edi+00h], dl
jo 00007F8528D7D732h
imul eax, dword ptr [eax], 5Ah
add byte ptr [ebp+00h], ch
jo 00007F8528D7D732h
je 00007F8528D7D732h
bound eax, dword ptr [eax]
push edi
add byte ptr [eax+eax+77h], dh
add byte ptr [ecx+00h], bl
xor al, byte ptr [eax]
xor eax, 63007300h
add byte ptr [edi+00h], al
push esi
add byte ptr [ecx+00h], ch
popad
add byte ptr [edx], dh
add byte ptr [eax+00h], bh
je 00007F8528D7D732h
bound eax, dword ptr [eax]
insd
add byte ptr [eax+eax+76h], dh
add byte ptr [edx+00h], bl
push edi
add byte ptr [ecx], bh
add byte ptr [eax+00h], dh
popad
add byte ptr [edi+00h], al
cmp dword ptr [eax], eax
insd
add byte ptr [edx+00h], bl
push edi
add byte ptr [esi+00h], cl
cmp byte ptr [eax], al
push esi
add byte ptr [eax+00h], cl
dec edx
add byte ptr [esi+00h], dh
bound eax, dword ptr [eax]
insd
add byte ptr [eax+00h], bh
jo 00007F8528D7D732h
bound eax, dword ptr [eax]
insd
add byte ptr [ebx+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b974	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b958	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e9ac	0x2ec00	84566df0b515c6bb19b3a653166f8ed1	False	0.4696795621657754	data	6.204990180609533	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c4	0x1cc00	f9e85790be7519386da34345138f8079	False	0.2372452445652174	data	2.605726988651011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x400	81fbfb1de1f36732da138237e2fb4305	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x321a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x466ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4df94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e40c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e478	0x34a	data	0.44418052256532065
RT_MANIFEST	0x4e7d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T01:04:41.369324+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:40.469456+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:44.633276+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:46.543269+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:43.619800+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:41.083135+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:44.974829+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:43.139769+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:51.050265+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49704	20.114.59.183	192.168.2.11
2024-07-26T01:05:29.373404+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49710	20.114.59.183	192.168.2.11
2024-07-26T01:04:40.215517+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:34.607725+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	40960	49703	185.215.113.67	192.168.2.11
2024-07-26T01:04:40.746049+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:46.794068+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:42.641660+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:42.092703+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:44.376979+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:47.090174+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:42.889746+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:47.382492+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:34.357258+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:45.344635+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:39.656148+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:43.871833+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:42.389735+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:39.912452+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	40960	49703	185.215.113.67	192.168.2.11
2024-07-26T01:04:45.351191+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67
2024-07-26T01:04:44.126664+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49703	40960	192.168.2.11	185.215.113.67

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 01:04:33.529637098 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:33.536215067 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:33.536293983 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:33.544835091 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:33.551567078 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:34.322802067 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:34.357258081 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:34.366214037 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:34.607724905 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:34.652086973 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:39.656147957 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:39.662527084 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.911968946 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.911987066 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.912090063 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:39.912393093 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.912404060 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.912415981 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.912441969 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:39.912451982 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:39.912499905 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:40.055435896 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.107574940 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:40.215517044 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:40.220875025 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.464502096 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.469455957 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:40.476306915 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.738526106 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.746048927 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:40.752722979 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.752732038 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.752855062 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.754359007 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.754518986 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:40.756521940 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.004015923 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.058247089 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:41.083134890 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:41.089750051 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.089796066 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.089823961 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.089852095 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.089886904 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.091490030 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.091517925 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.091545105 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.091572046 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.093069077 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.093120098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.093147993 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.093199968 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.093228102 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.359747887 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.369323969 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:41.375925064 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.616658926 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:41.667635918 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:42.092703104 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:42.100474119 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:42.341480017 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:42.386363983 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:42.389734983 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:42.396780968 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:42.639616013 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:42.641659975 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:42.646531105 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:42.887201071 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:42.889745951 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:42.896094084 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:43.137888908 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:43.139769077 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:43.146306038 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:43.389025927 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:43.433254957 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:43.619800091 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:43.627530098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:43.866590977 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:43.871833086 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:43.878879070 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.120496988 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.126663923 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:44.133294106 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.374177933 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.376979113 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:44.383661032 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.625199080 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.633275986 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:44.641227007 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.882996082 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:44.933321953 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:44.974828959 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:44.981293917 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.221921921 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.276992083 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.344635010 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.351056099 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.351090908 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.351104021 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.351109028 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.351191044 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.351226091 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.351242065 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.351294041 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.352818012 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.352834940 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.352848053 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.352859020 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.352879047 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.352904081 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.354521036 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.354558945 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.354585886 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.354625940 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.357307911 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.357382059 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.357389927 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.357429028 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.357498884 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.357863903 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.357875109 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.357925892 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.358988047 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.359075069 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.360800982 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.360894918 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.361018896 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.361068010 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.362515926 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.362612963 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.362637997 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.362694025 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.363660097 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.363671064 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.363696098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.363707066 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.363748074 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.363781929 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.364015102 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.364070892 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.364203930 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.364213943 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.364264965 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.364267111 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.364319086 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.365448952 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.365459919 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.365492105 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.365499973 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.365513086 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.365515947 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.366769075 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367113113 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367182970 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367679119 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367691040 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367698908 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367733955 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367744923 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367758989 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367767096 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367777109 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367784977 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367794991 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367804050 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367814064 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367820978 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367830992 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367841005 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.367901087 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.368927956 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369004011 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369014025 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369044065 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369054079 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369107008 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.369225979 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369235992 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369240046 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369242907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369246960 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369259119 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369267941 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369294882 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.369327068 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.369688988 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369699955 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369709015 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.369740963 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.369774103 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.370172977 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370193005 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370213985 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370223045 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370234013 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.370271921 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.370727062 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370738029 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370745897 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370755911 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.370785952 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.371970892 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.371982098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372126102 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372133970 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372143030 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372150898 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372159004 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372167110 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372169971 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372176886 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372641087 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372652054 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372659922 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372668982 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.372677088 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.373198986 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.373385906 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.373554945 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374387026 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374396086 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374406099 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374414921 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374454021 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374460936 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374485016 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374494076 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374504089 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374550104 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374550104 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374560118 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374571085 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374603033 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374618053 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374635935 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374681950 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374814034 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374824047 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374830961 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374840021 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374849081 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374855995 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374864101 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374866962 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374871969 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374875069 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374891996 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374901056 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374910116 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374912977 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374928951 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374932051 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374938011 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374948978 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374958992 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.374963045 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.374978065 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.375000954 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.376205921 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376276970 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376286030 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376382113 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376390934 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376398087 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376406908 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376424074 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376432896 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376441002 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376466990 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376475096 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376478910 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376524925 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376534939 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376668930 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376677036 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376683950 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376693010 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.376701117 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.377011061 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.377095938 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.377104044 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.377113104 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.377120972 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.378247976 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.378258944 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.378393888 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.378628016 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.379925966 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.379936934 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.379962921 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.379972935 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.379981041 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.379996061 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380032063 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380053043 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380100965 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380110979 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380120039 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380127907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380136967 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380148888 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380183935 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380319118 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380330086 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380338907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380347967 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380357027 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380376101 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380410910 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380629063 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380639076 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380671978 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380681038 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.380681992 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380692005 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.380701065 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381751060 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381771088 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381779909 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381911039 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381987095 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381994963 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.381999969 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382006884 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382074118 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382082939 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382090092 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382097960 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382106066 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382196903 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382206917 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382214069 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382220984 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382230043 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382241011 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382251024 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382533073 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382584095 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382643938 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382807970 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382817030 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382824898 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382833958 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382841110 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382849932 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382858038 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382867098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.382875919 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.383065939 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385005951 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385016918 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385061026 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385071039 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385099888 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385108948 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385119915 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385129929 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385149002 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385171890 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385190964 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385221004 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385236025 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385255098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385265112 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385267973 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385313988 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.385416031 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385426998 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385436058 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385445118 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385454893 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.385466099 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386228085 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386281013 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386290073 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386300087 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386346102 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386354923 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386403084 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386413097 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386501074 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386509895 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386512995 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386538029 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386548996 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386698961 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386708975 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386717081 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.386725903 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387033939 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387044907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387126923 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387136936 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387343884 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387355089 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387363911 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387372971 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387382030 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387391090 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387402058 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387411118 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.387419939 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388170958 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388192892 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388214111 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388277054 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388386965 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388396978 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388405085 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388415098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.388783932 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.389480114 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389530897 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.389544964 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389556885 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389586926 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.389616013 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389619112 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.389626026 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389689922 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389750957 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389760017 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389905930 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389915943 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389924049 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389934063 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389944077 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389986992 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.389996052 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390059948 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390069962 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390078068 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390199900 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390209913 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390218019 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390227079 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390239000 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390281916 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390364885 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390376091 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390381098 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390413046 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390486002 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390496016 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390626907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390636921 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390645027 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390654087 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390664101 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390758991 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390769005 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390777111 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390784979 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390794039 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390803099 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.390856981 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.391516924 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.391530037 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.391568899 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.391577959 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.391762018 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392180920 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392200947 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392209053 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392218113 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392230034 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392237902 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392453909 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.392714024 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.392834902 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.395045042 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395056009 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395107985 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395117044 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395124912 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395173073 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395181894 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395186901 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395262003 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395270109 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395788908 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395798922 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395807028 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395814896 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395823002 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395831108 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395840883 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395848989 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395857096 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395859957 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395868063 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395876884 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395879984 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395890951 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395899057 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395906925 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395925045 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395934105 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395941973 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395950079 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395952940 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395956039 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.395963907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396007061 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396086931 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396095037 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396102905 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396142960 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396151066 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396203041 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396209955 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396214008 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396220922 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396229029 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396563053 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396573067 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396583080 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396591902 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396600962 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.396610022 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.397281885 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.397319078 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.397330046 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.397543907 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.397825003 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.397928953 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.399027109 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399036884 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399045944 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399054050 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399307013 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399317980 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399326086 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399333954 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399343014 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399353981 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399363995 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399372101 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399382114 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399391890 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399400949 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399472952 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399595976 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399605989 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399714947 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399728060 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399770975 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399799109 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.399810076 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400166988 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400177002 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400185108 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400193930 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400203943 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400213957 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400223017 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400232077 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400240898 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400249958 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400259018 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400269985 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400461912 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400526047 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400535107 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400544882 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.400553942 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401438951 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401448965 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401458979 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401467085 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401470900 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401479959 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401489019 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401499033 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401508093 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401518106 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401526928 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401535034 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401545048 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401556015 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.401771069 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.401886940 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.404711962 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.404723883 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.404876947 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.404923916 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405020952 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405031919 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405297995 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405308008 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405317068 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405325890 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405335903 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405345917 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405349970 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405358076 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405365944 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405374050 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405381918 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405390024 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405400038 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405407906 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405420065 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405431032 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405450106 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405458927 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405462980 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405471087 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405483007 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405493021 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405503035 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405512094 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405559063 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405567884 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405608892 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405618906 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.405785084 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.449433088 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:45.449749947 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:45.501465082 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:46.506551981 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:46.543268919 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:46.549978971 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:46.793303013 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:46.794068098 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:46.800292969 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:47.088644028 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:47.090173960 CEST	49703	40960	192.168.2.11	185.215.113.67
Jul 26, 2024 01:04:47.096390963 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:47.348496914 CEST	40960	49703	185.215.113.67	192.168.2.11
Jul 26, 2024 01:04:47.382492065 CEST	49703	40960	192.168.2.11	185.215.113.67

Target ID:	5
Start time:	19:04:30
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x100000
File size:	311'296 bytes
MD5 hash:	A9A37926C6D3AB63E00B12760FAE1E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000000.1284557443.0000000000102000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1537465544.0000000002498000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1537465544.00000000027A3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	72
Total number of Limit Nodes:	9

Executed Functions

Function 0722B380 Relevance: 17.9, Strings: 14, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR_q, xrefs: 0722B38D
$_q, xrefs: 0722BC38
Hcq, xrefs: 0722B73B
$_q, xrefs: 0722BC85
Hcq, xrefs: 0722B7B3
Hcq, xrefs: 0722B7E4
$_q, xrefs: 0722BC95
4|dq, xrefs: 0722C1CD
Hcq, xrefs: 0722B76C
4c_q, xrefs: 0722BA4F
4'_q, xrefs: 0722BDD6
4c_q, xrefs: 0722BA3D
$_q, xrefs: 0722BDC7
4c_q, xrefs: 0722BA59

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID: 4'_q$4c_q$4c_q$4c_q$4|dq$Hcq$Hcq$Hcq$Hcq$LR_q$$_q$$_q$$_q$$_q
API String ID: 0-4055236990
Opcode ID: 82f1fa24aae8703bd23fd56368915cb07283b7132b1f8348a4856d4b7ffa40bd
Instruction ID: 5f67e6e979d8d27656de75594b4d10de01c569c98b64276d53bf15ec217501f4
Opcode Fuzzy Hash: 82f1fa24aae8703bd23fd56368915cb07283b7132b1f8348a4856d4b7ffa40bd
Instruction Fuzzy Hash: 53D1E5F0A241279FCB199B79C4642BDBBF2EF86300F148469D446DB291FB78D942E750

Function 07227A28 Relevance: 16.2, Strings: 12, Instructions: 1187COMMON

Download Yara Rule

Strings

$_q, xrefs: 07228A4B
Nv^q, xrefs: 07227D30
$_q, xrefs: 072280B3
c_q, xrefs: 072283F6
4c_q, xrefs: 072283A2
4c_q, xrefs: 072283BC
(__q, xrefs: 072284DE
(__q, xrefs: 072284C4
Hcq, xrefs: 072287E2
,cq, xrefs: 07228647
$_q, xrefs: 072280CD
c_q, xrefs: 072283DC

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID: (__q$(__q$,cq$4c_q$4c_q$Hcq$Nv^q$$_q$$_q$$_q$c_q$c_q
API String ID: 0-2707661932
Opcode ID: 91fd1c56b52b3f2b44320420feb0ba046f9f392bb47dae2351e284cc07806a90
Instruction ID: 53622c8cda8edfddfc3ad24262dbc989d6fbd21b40f04e3915e99f9c1e42a56d
Opcode Fuzzy Hash: 91fd1c56b52b3f2b44320420feb0ba046f9f392bb47dae2351e284cc07806a90
Instruction Fuzzy Hash: 3882B6B0B101259FCB699BBE541123D66D3BFCD740B2049A9E50ADF395EE34CD42CBA2

Function 07221BD0 Relevance: 6.6, Strings: 5, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hcq, xrefs: 07221FB1
Hcq, xrefs: 07221F80
Hcq, xrefs: 07222070
Hcq, xrefs: 07221FE2
Hcq, xrefs: 07222029

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID: Hcq$Hcq$Hcq$Hcq$Hcq
API String ID: 0-1692708840
Opcode ID: 8fa6f2485240d482943a99e1b005df0acf8d77f1a292c700b8b9350aacb814a5
Instruction ID: 6db9eb5017ec59a7f28d5b08efa0cd5ef3183e2ee7becd24497001d8e8a500b4
Opcode Fuzzy Hash: 8fa6f2485240d482943a99e1b005df0acf8d77f1a292c700b8b9350aacb814a5
Instruction Fuzzy Hash: 76F1E3B0A2026BDBCB19CF74C4505BDFBB2FF85300F248669D806AB251D774DA92DB90

Function 0722F9F0 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0722FC3B
$_q, xrefs: 0722FBA1
$_q, xrefs: 0722FB8B
$_q, xrefs: 0722FC51

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 2b99a3f649ffb2fecfc9cf8cfa75ad21c00d7f8e9934f3aecd459b195baac00d
Instruction ID: 93e784ec2b290a968ebcf8a79907cc2103d783f6d19bec35ea4cfd533ec83aff
Opcode Fuzzy Hash: 2b99a3f649ffb2fecfc9cf8cfa75ad21c00d7f8e9934f3aecd459b195baac00d
Instruction Fuzzy Hash: 60C10AB0E1121DDFDB68DFA5C99079EBBB2BF89300F1085A9C409AB354DB749986CF41

Function 0722B828 Relevance: 4.3, Strings: 3, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 0722BA1D
$_q, xrefs: 0722BDC7
4|dq, xrefs: 0722C1CD

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID: 4|dq$$_q$$_q
API String ID: 0-2093243903
Opcode ID: fd445593cd81d22a9d2a80f26e322e8500480a2f40635c2430258cef27d793ad
Instruction ID: ecc06943db639450ffd1cfd9654491666b38ccf7684c9a96bbaa23fd6d26ab70
Opcode Fuzzy Hash: fd445593cd81d22a9d2a80f26e322e8500480a2f40635c2430258cef27d793ad
Instruction Fuzzy Hash: 680281B0B102199FDB18DF7AC8546AEBBB6BF89300F148469E409DB351EF74DD428B91

Function 07220040 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 072202C0
1, xrefs: 07220345

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 553e1dc2c4887018d43a34af1287cfc1741920f8b88abb01f902ef4261280ed9
Instruction ID: eb872991a436838956874a71ebacc793e3c1a6748cd21336dcda9e064bbcd2fa
Opcode Fuzzy Hash: 553e1dc2c4887018d43a34af1287cfc1741920f8b88abb01f902ef4261280ed9
Instruction Fuzzy Hash: 3DF1DE74E01229DFDB28CF65C984BDDBBB2BF89305F1081AAD509AB250DB759E81CF10

Function 07222D18 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da90ce0ee15b17866b7a5ec6976ae90a88f812ca3d7bd1c73a23cf11f756190
Instruction ID: 2f24570eeb114886baf790a50c5543d56cbcb68328882b9a233ae130978b22cf
Opcode Fuzzy Hash: 7da90ce0ee15b17866b7a5ec6976ae90a88f812ca3d7bd1c73a23cf11f756190
Instruction Fuzzy Hash: FA829EF4620223DFDB24DF68D648B6A77F1BB48308F1081A8C9099B756DB38D986DF51

Function 05D467D8 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c6befdbe4ec4dfd5e722c4d22239a1cbc5f805db64cc7c41643b43f7264ab9
Instruction ID: cf5b5f016ccc78865955bdb96e634b0f9ca6dcffb69ba905f8fd7a5879d6e3e6
Opcode Fuzzy Hash: e3c6befdbe4ec4dfd5e722c4d22239a1cbc5f805db64cc7c41643b43f7264ab9
Instruction Fuzzy Hash: 64F1B370A002099FDB15DF69D884B9EBBF2FF89300F14856AE50ADB261DB31ED45CB91

Function 0722EF78 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464a19d595d40f4e70516edb1ed5174effcff4ba7c4603a86f44551783249b7a
Instruction ID: b76b5ffdb223e917136a1b454f608c86d07336308c00601088a178baf628454b
Opcode Fuzzy Hash: 464a19d595d40f4e70516edb1ed5174effcff4ba7c4603a86f44551783249b7a
Instruction Fuzzy Hash: 3AE1D6B4E11219DFDB14CFA9C984B9DFBB2FF48310F2481A9D409AB255D734A986CF50

Function 05D4A3D8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde46cdd2910bffe4efa0a00f2a2cea0464fc6e06e16e3c9d60635c6e99d7e71
Instruction ID: 3aa84451747c16f538de867773ee87a6083ad40bb53add07b3dbd9287cc2dcea
Opcode Fuzzy Hash: bde46cdd2910bffe4efa0a00f2a2cea0464fc6e06e16e3c9d60635c6e99d7e71
Instruction Fuzzy Hash: 7CD10634E00208CFDB58EFB4D848A9DBBB2FF8A301F1095A9E50AAB354DB355985CF11

Function 05D4A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537688df6458f6a220985183086e104f73bd8c683df42bfc8d4f373794bd1f9f
Instruction ID: 9ffd3a0bf28f11a66ec8df500bb5aeac5e7a111963a91fe72f39b081dcf0d5b2
Opcode Fuzzy Hash: 537688df6458f6a220985183086e104f73bd8c683df42bfc8d4f373794bd1f9f
Instruction Fuzzy Hash: 6BD1D534A00218CFDB18EFB4D858A9DBBB2FF8A301F5095A9E50AAB354DB355985CF11

Function 0722F9E0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240a3e0a3c41cb6870342683eeb79045c595dc425d93fedf67599625e4c2050f
Instruction ID: 4be1a71e853f853a2d84d1d008aa17dc6290c36e7a7f5ee869458a0f22ac2ade
Opcode Fuzzy Hash: 240a3e0a3c41cb6870342683eeb79045c595dc425d93fedf67599625e4c2050f
Instruction Fuzzy Hash: 9641F7B0E00609DFDB18DFAAC95469EFBF2BF89300F24C52AC419AB254DB745942CF51

Function 05D30D80 Relevance: 20.6, Strings: 16, Instructions: 617
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 05D30E52
$_q, xrefs: 05D313A0
$_q, xrefs: 05D30FB8
$_q, xrefs: 05D313EB
$_q, xrefs: 05D30E84
$_q, xrefs: 05D31336
$_q, xrefs: 05D30FAC
$_q, xrefs: 05D31461
$_q, xrefs: 05D313AC
$_q, xrefs: 05D30E02
$_q, xrefs: 05D3137B
$_q, xrefs: 05D31455
$_q, xrefs: 05D30E78
$_q, xrefs: 05D30F86
$_q, xrefs: 05D30F36
$_q, xrefs: 05D31430

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-585025184
Opcode ID: 10534a2618f218d175ccf29377efbb51ef42529625540a3cdad9ee937c11667e
Instruction ID: a58ba1aa4eb82f7bb4b501e271310077a5af2af3d18121cad0f6261fad0fe4dd
Opcode Fuzzy Hash: 10534a2618f218d175ccf29377efbb51ef42529625540a3cdad9ee937c11667e
Instruction Fuzzy Hash: 0C227D70B046069FCB15DBA9C859A7ABBF7BF88710B14846AE506DB3A2CF70DC41CB51

Function 05D31582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 05D31A7C
$_q, xrefs: 05D318E3
$_q, xrefs: 05D31A88
$_q, xrefs: 05D3182E
$_q, xrefs: 05D31A57
$_q, xrefs: 05D31A12

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: 9361f10eab1465c366ff09443ee25426e8fbcaf17a5e44bd55c3ba618ea11882
Instruction ID: 6e730b33b8f31e05beff3e770f3a00301e811bb2d30935671ba1544799c95ef2
Opcode Fuzzy Hash: 9361f10eab1465c366ff09443ee25426e8fbcaf17a5e44bd55c3ba618ea11882
Instruction Fuzzy Hash: 26C1AD707042069FDB149BA9C859A3E7BE7BF89704F14886AE5038B3A2DFB5DC01CB51

Function 048DAE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,Vu, xrefs: 048DAFE3
,Vu, xrefs: 048DAFBE

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: HandleModule
String ID: ,Vu$,Vu
API String ID: 4139908857-2887643215
Opcode ID: 37c082bdae7ebcaacf877c5d1303746ba73a502e688b46786c45bf61c4b78e9c
Instruction ID: 7818f9607e901b79a86535c4e33e889adde2bb748674b2821d178eabe14524a4
Opcode Fuzzy Hash: 37c082bdae7ebcaacf877c5d1303746ba73a502e688b46786c45bf61c4b78e9c
Instruction Fuzzy Hash: DD7113B0A01B458FDB28DF2AC04475ABBF1FF88304F148A29D44ADBA50D779F945CB91

Function 05D31291 Relevance: 2.6, Strings: 2, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 05D313EB
$_q, xrefs: 05D31336

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: e280155556149dbf4d3a2ba14b691fd304ccf5e6dfbfd6f298b8dc0497476f62
Instruction ID: 5fb52e0d1929a833f467d182fd3865e7138a10906ee93315530ebd40b6b64601
Opcode Fuzzy Hash: e280155556149dbf4d3a2ba14b691fd304ccf5e6dfbfd6f298b8dc0497476f62
Instruction Fuzzy Hash: F441D774700202AFD754A7E98C56A3B76EBAF88714F15442AFA029F391CEA1CC41C761

Function 05D30598 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

lPj, xrefs: 05D3059C

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID: lPj
API String ID: 0-2102322720
Opcode ID: 653b2ef627b732980a3b0b1408add40ccf9e91b4c6887fe93e662412b085a430
Instruction ID: 415a25336d36fefc0abf1c8df490e861180a53ae32663a93058a818766d2488b
Opcode Fuzzy Hash: 653b2ef627b732980a3b0b1408add40ccf9e91b4c6887fe93e662412b085a430
Instruction Fuzzy Hash: 24028D707006148FDB259B68D859A2E7BF6FBC9704F044969E5039F3A1CBB9ED01CB92

Function 05D43F50 Relevance: 1.6, Strings: 1, Instructions: 393COMMON

Download Yara Rule

Strings

$_q, xrefs: 05D441E4

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: $_q
API String ID: 0-238743419
Opcode ID: 761fef8041d5dccb57f4456bbbcb71cf0fa8e99088b999e55b347431811be72a
Instruction ID: a398ed4999353de6c819ff42cd7eebb5b317d509c358a0a3a89f64742edff883
Opcode Fuzzy Hash: 761fef8041d5dccb57f4456bbbcb71cf0fa8e99088b999e55b347431811be72a
Instruction Fuzzy Hash: 39E12D74B102158FCB14DF69C594AAEBBF6BF88700B14856AE906EB365EB31DC41CF90

Function 048D5935 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 048D59F1

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 808392955284e55398eb66a0c03eb63ebab72e1d5c07bc3b4c440b0a06946dfa
Instruction ID: b3ca945a4f6dc5eab1c530cacf6cd6c10e20ad1dd29902d8ca08f8b16555005a
Opcode Fuzzy Hash: 808392955284e55398eb66a0c03eb63ebab72e1d5c07bc3b4c440b0a06946dfa
Instruction Fuzzy Hash: 7541E2B0D01629CFDB24DFA9C984BCDBBB5FF48304F24856AD408AB251DB756946CF90

Function 048D4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 048D59F1

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: be562eccf54a860f953e26ee17cace56e5118500e7ebc8e7e6e8259cc1235547
Instruction ID: 51576d41d12aa937632fb58cfb94878972604e5a322d8cb1b0c81bb01e2589be
Opcode Fuzzy Hash: be562eccf54a860f953e26ee17cace56e5118500e7ebc8e7e6e8259cc1235547
Instruction Fuzzy Hash: 8B41EFB0D0162DDBDB24DFA9C884B8DBBF5FF48304F20856AD408AB250DB756945CF90

Function 048DC9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,048DD2C6,?,?,?,?,?), ref: 048DD387

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c56aff8548f283952fb197874e5c80104f0fa79d6fc32a2f24798b211c82e5d0
Instruction ID: 6aa1eb5e49096f47c6ea9d4ad64f1278448c28b2a865646fae0f2e812779153a
Opcode Fuzzy Hash: c56aff8548f283952fb197874e5c80104f0fa79d6fc32a2f24798b211c82e5d0
Instruction Fuzzy Hash: D721E5B5901248DFDB10CF9AD984AEEBBF4EB48320F14841AE914E7310D379A954CFA5

Function 048DD2F9 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,048DD2C6,?,?,?,?,?), ref: 048DD387

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 824c100b05eb1bb93aaa0829077011093584a4f64a2351c51db7262611f3f3fa
Instruction ID: eb9a6167e0ede3e7a72acc19b6208dfc016b9a23502d0e4851eb913438ad6e27
Opcode Fuzzy Hash: 824c100b05eb1bb93aaa0829077011093584a4f64a2351c51db7262611f3f3fa
Instruction Fuzzy Hash: 1821E2B5900249DFDB10CFAAD980ADEBBF5EB48320F14841AE918B7350D378A944CF61

Function 072259E0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,07225946), ref: 07225A4E

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 226fc0136820cc1115efa8d3697d0ae5de17441a8b86ce048ea9e8c7f120f15a
Instruction ID: 564e895dcc5b30cf688b08ceb589a940ae5cf162eb0efc2b148e0e35e4db7c26
Opcode Fuzzy Hash: 226fc0136820cc1115efa8d3697d0ae5de17441a8b86ce048ea9e8c7f120f15a
Instruction Fuzzy Hash: 361153B1C0035ADFDB10CFAAC844A9EFBF4EF88320F14846AD419A7200D378A506CFA1

Function 048DA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,048DB101,00000800,00000000,00000000), ref: 048DB312

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fc2f46dd573fe69742a65ed468c2c3db5618b1cb025aa0d4ba84f0b378b58e07
Instruction ID: d98486ba51ed57a3108d4a3d77dab835f3655d0265fe34a32ff2f1f156e6e3e9
Opcode Fuzzy Hash: fc2f46dd573fe69742a65ed468c2c3db5618b1cb025aa0d4ba84f0b378b58e07
Instruction Fuzzy Hash: 851114B6D003499FDB10CF9AC444A9EFBF4EB48320F15892ED519A7200C375A544CFA5

Function 048DB2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,048DB101,00000800,00000000,00000000), ref: 048DB312

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 44b1b3b8509c7eb0dac67f43c721a72684ba569215e9157389bc21b9ff52a7bb
Instruction ID: c994dc161aa12c615bc248ffe51241ea4ffe79a3af93faeb7a7f7581e884e163
Opcode Fuzzy Hash: 44b1b3b8509c7eb0dac67f43c721a72684ba569215e9157389bc21b9ff52a7bb
Instruction Fuzzy Hash: F71114B6D00249CFDB14CF9AC984ADEFBF4EF88310F15851AD419A7640C375A545CFA1

Function 07225454 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,07225946), ref: 07225A4E

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 00238f08fbdc40f5f61e9a6c593d2bc21323b74ef4c072f1c5a5d232c518c8c7
Instruction ID: 4c9ba242e4efb00591f75d69d307cd5ba63636584b3a5f89c57f03e773a7d76f
Opcode Fuzzy Hash: 00238f08fbdc40f5f61e9a6c593d2bc21323b74ef4c072f1c5a5d232c518c8c7
Instruction Fuzzy Hash: 761123B5C10359DBDB10CF9AC545A9EFBF4EF88320F14845AD419AB300D375A506CFA1

Function 05D459C8 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

d, xrefs: 05D45C29

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 015c422725d753a245ec35e0a77e9feff9d0ecff4575ecba8b39ef932e358f8f
Instruction ID: 336315e6601620384142e291c6e99e16e9910081606e825a9f7aa6091e6744aa
Opcode Fuzzy Hash: 015c422725d753a245ec35e0a77e9feff9d0ecff4575ecba8b39ef932e358f8f
Instruction Fuzzy Hash: 78C16C35600606CFCB14CF59D584D6ABBF2FF88314B25C99AD59A8B665DB30F846CF80

Function 048D9838 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,048DAE4C), ref: 048DB086

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d7de0d0ba1594b9af027aaa7e7f81cf7463d214d796b900c51f04bdce641d1cf
Instruction ID: 44080845f5912e4703e22fe3c23d98ac20fbc957c2811353d0c113207cc30d34
Opcode Fuzzy Hash: d7de0d0ba1594b9af027aaa7e7f81cf7463d214d796b900c51f04bdce641d1cf
Instruction Fuzzy Hash: 5C1123B5C00349CBDB20DF9AC444B9EFBF4EB48320F15891AD428B7200D375A909CFA1

Function 05D43DE0 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D43F25

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 9c0e9b4e465666621459d0e687b7e7a5c353478d1ad6acd1da5e22cfeb3da110
Instruction ID: a28ad6b1241640a73d193fe3508f120cba7b883633f5747088e9c3d101d15083
Opcode Fuzzy Hash: 9c0e9b4e465666621459d0e687b7e7a5c353478d1ad6acd1da5e22cfeb3da110
Instruction Fuzzy Hash: 183104B17042508FC71AA778A4501AE3BE6EFCA311355487AE08ACB752DF24EC0687E1

Function 05D484C8 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D485B1

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: eb3ccd20ac1e9965fd3a536972ad398e13eed99bd42228ccafec533f545d8b2e
Instruction ID: 299fe4720c72256118bbba9d46d115743f8164d7f30f5bb8443ff957d6c0746e
Opcode Fuzzy Hash: eb3ccd20ac1e9965fd3a536972ad398e13eed99bd42228ccafec533f545d8b2e
Instruction Fuzzy Hash: CB31BC757002168FCB09ABB9A4A467E77E3AFC86197104839D50ADF385EE34CC068BD2

Function 05D4B358 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D4B399

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 3a356540b06bbeedd8bb2122b19b2370af48942f9035c47383025a1f1dc9c5db
Instruction ID: 610883d2df1ac70577b53ff867d720d43c1b26a05574547b79cdb57494a0ff0a
Opcode Fuzzy Hash: 3a356540b06bbeedd8bb2122b19b2370af48942f9035c47383025a1f1dc9c5db
Instruction Fuzzy Hash: 8601B1B4901249EFCB49EF78E88948C7FB6FB44300B108599E80A97251EB301E44CF12

Function 05D43EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D43F25

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 8b837bd6988549b1ac3f220b5bfcde478688fdafd0ef2e2dd0b171fe6b2a65eb
Instruction ID: 9f4fac21bba6b6db1ce296d84c5282ea14924582c078f5a6409d7c8ed6632cc7
Opcode Fuzzy Hash: 8b837bd6988549b1ac3f220b5bfcde478688fdafd0ef2e2dd0b171fe6b2a65eb
Instruction Fuzzy Hash: E5F090B13001018FC61CEB6AE49596E77E7DBCD2113544D28F00A9B714EF24BD4687E2

Function 05D4B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'_q, xrefs: 05D4B399

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: f0c33e51d97e2c59af27a7faa654a7e844eb2061cb1152b72950a9fad0e7f611
Instruction ID: e723cc95b6625c0ea522a022841b1cc62f1fa4c46e53133712abea1a919f2f7c
Opcode Fuzzy Hash: f0c33e51d97e2c59af27a7faa654a7e844eb2061cb1152b72950a9fad0e7f611
Instruction Fuzzy Hash: 87F03174A01209EFCB08EFB9E58D55D7BB6FB44300F1085A9E80A97350EB306E54CF41

Function 05D32078 Relevance: 1.0, Instructions: 1042COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0ad7faeb6a8ee941aa111c7736cdd5d60e3b24521c891cc105a5fc9088547b
Instruction ID: b95f09bf715cb6eaf1209504cc7207158e0357381aa5e3a0494f858daa62e5b2
Opcode Fuzzy Hash: 4c0ad7faeb6a8ee941aa111c7736cdd5d60e3b24521c891cc105a5fc9088547b
Instruction Fuzzy Hash: 1C924074B006189FDB159B64CC55BEEBBB2FF88700F10849AE506AB3A1DB719D81CF91

Function 05D33838 Relevance: .9, Instructions: 884COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9499f755d9bdb1df01d685338db44de3babb104a00378d4ee25a407efb0b948b
Instruction ID: 66ce354e99ed09d8e366d3da3e579df069c7a38ddbcc929c6fc86735e06505b8
Opcode Fuzzy Hash: 9499f755d9bdb1df01d685338db44de3babb104a00378d4ee25a407efb0b948b
Instruction Fuzzy Hash: 63722874B002049FCB44DF69C895E6ABBF6BF89700F15809AE506DB3A6DB71ED40CB61

Function 05D31EC8 Relevance: .7, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d2b36b9a0e91320e27bf648c3acfa9c355a9d15f41e802b04a81c54c37946b
Instruction ID: 509c3a74cb9c0f1fce1c93c7319ab3de3eac3b1183896b2f0c67fb558b4def8f
Opcode Fuzzy Hash: 27d2b36b9a0e91320e27bf648c3acfa9c355a9d15f41e802b04a81c54c37946b
Instruction Fuzzy Hash: FE526F74B002149FDB149B64C855EAE77B2FF88704F21849AE9069F7A2CB71ED81CF91

Function 05D300D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8951b3148f7a5ea3cf73234434f9b9bec8abba93a53a61a6e84e0804133a74
Instruction ID: 1d43244efee0c136a31a5c595299ffde8ca3b74e07e478250c52c9caac93a1a4
Opcode Fuzzy Hash: ed8951b3148f7a5ea3cf73234434f9b9bec8abba93a53a61a6e84e0804133a74
Instruction Fuzzy Hash: FA426770700A198FCB29AF79D45462E7BF2FBC5304B404A5CD507AF3A5DBB9AD018B86

Function 05D34951 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ae1185e4eeea1d7bf5df79620dbec80dbdbc1098f904933afa223ab3fac53b
Instruction ID: 6fcfc874148aac9240e9c889d1f6599453b9afb6aae38242573c7c59fd02e723
Opcode Fuzzy Hash: 47ae1185e4eeea1d7bf5df79620dbec80dbdbc1098f904933afa223ab3fac53b
Instruction Fuzzy Hash: 38F19E707142049FCB55DF68C859E6ABBF6FF89310B1584AAE506DB3A2CB35DC01CBA1

Function 05D448A8 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b4d39689fb2cb3e079d4200a47a4d044cd871e31966fce6a7b2f31ad220622
Instruction ID: 1c816799e9c2a8b4bf95a7d87e70a1b3873c47484803483307d1b3dfc6860ea9
Opcode Fuzzy Hash: 72b4d39689fb2cb3e079d4200a47a4d044cd871e31966fce6a7b2f31ad220622
Instruction Fuzzy Hash: 041226747006058FCB14DF69C988A6ABBF2FF88305B1584A9E546DB362DB31EC85CF50

Function 05D30610 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0397890a507006b013dd2bbe3efb60eca3bc3bb4fadeebc7a6180a91ece45a
Instruction ID: 31be5d31fc474867f47a640ed07a17edbedced73c54f8ff816e385d2b3263010
Opcode Fuzzy Hash: ec0397890a507006b013dd2bbe3efb60eca3bc3bb4fadeebc7a6180a91ece45a
Instruction Fuzzy Hash: C1026C707006048FDB149B68D859A2E7BE6FBC9704F144969E9039F3A1CFB9ED41CB92

Function 05D30700 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6429eb10f1577ce69bedf42268d4e84130d86ce1d8191dc018d2542c34112dd4
Instruction ID: 54fa6adf73aeddac72c276693fa7e6dd8b318e7156c3a61b1e48464eff79841c
Opcode Fuzzy Hash: 6429eb10f1577ce69bedf42268d4e84130d86ce1d8191dc018d2542c34112dd4
Instruction Fuzzy Hash: 46D15B707006049FDB149B68C859B3A7BE6FF89704F14846AE9029F3A1CBB9ED41CF91

Function 05D300BB Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b68ecdc1a92355f975160b86a39212394cfd86264928a892dff1500d4cfa37d
Instruction ID: 9db323a9ed92b804e067b64fd9646327b4e9681072483fc2b91aeeea578eb9cc
Opcode Fuzzy Hash: 0b68ecdc1a92355f975160b86a39212394cfd86264928a892dff1500d4cfa37d
Instruction Fuzzy Hash: 18C16D747012049FDB149B68C85AB7A7AE6FF89704F148066E902DB3A1CBB5ED41CFA1

Function 05D3067A Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599abdcec82e90047165bcd4bb6c74b899d6cc90e4b4538a47f8c70926f02730
Instruction ID: df7ac8269b65f2becacc7d4b3563f014b36b77e80a6055d7f4f689bb9ed984ba
Opcode Fuzzy Hash: 599abdcec82e90047165bcd4bb6c74b899d6cc90e4b4538a47f8c70926f02730
Instruction Fuzzy Hash: 45C15C747012049FEB149B68C859B7A7AE7FF89704F148066EA029F3A1CBB5ED41CF91

Function 05D47D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a83661abdd47a98532e27ea5d48fe232ea5757a63524da3c1acb552d6f26234
Instruction ID: 45d46e38455a27d552bdc142ec504082a061fbbe31915318a07bdf6b236b5375
Opcode Fuzzy Hash: 3a83661abdd47a98532e27ea5d48fe232ea5757a63524da3c1acb552d6f26234
Instruction Fuzzy Hash: 9A513671E00259DFDB19CFA9C980B9EBBF6FF48310F14852AD415AB244DB749942CF91

Function 05D334D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d61be1bb8b7f17e97006ba1cccaab52caa043bed4b186abe11c629cb6dfe2d8
Instruction ID: 0ced6dcf676dea23b17be52d38324ed3b619b8f692b474c03ee030403a050883
Opcode Fuzzy Hash: 0d61be1bb8b7f17e97006ba1cccaab52caa043bed4b186abe11c629cb6dfe2d8
Instruction Fuzzy Hash: 13513935B105099FCB44DF69C884DAABBF2FF89310B15846AE906AB361DB70EC05CB50

Function 05D33328 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545658272.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c35349ca45dc9604f680e02c9c45611b8e1cf10071fb6109cf41b5fa901bab
Instruction ID: 243bc99fd8d55a331bd56b2c3bdcb0e065bb4f4490907aecb7d70b1ce17bd154
Opcode Fuzzy Hash: a7c35349ca45dc9604f680e02c9c45611b8e1cf10071fb6109cf41b5fa901bab
Instruction Fuzzy Hash: C9510935B10618AFCB44CF69C984DAEBBB6FF89710B15846AED05AB361DB31EC05CB50

Function 05D47D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b608fe4edaa6d680adaff8639bb589e9d27ba199ff63e9e9e40c5820fc79c4e1
Instruction ID: 19856fbb0a728105b1650a014eaf4b012a69398aadc9542faa28191adb27cf1a
Opcode Fuzzy Hash: b608fe4edaa6d680adaff8639bb589e9d27ba199ff63e9e9e40c5820fc79c4e1
Instruction Fuzzy Hash: 465145B1E00259DBDB19CFA9C980B9DBBF5FF48300F14852AD419EB280DB749842CF81

Function 05D45588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a6dc5e149bf78dd1af599d73f81596129e65cd231ecc102ad7c1a2338f6c19
Instruction ID: 29984af72b177bd4733b945543bc80912056a0e1037cbc3d8810d180b9fb43e6
Opcode Fuzzy Hash: 60a6dc5e149bf78dd1af599d73f81596129e65cd231ecc102ad7c1a2338f6c19
Instruction Fuzzy Hash: 7B3178747012149FCB15DF79D888A6EBBB6FF89341B4088A9E906CB355DB31ED01CB90

Function 05D45579 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb21ae9a8738533b0d78ff7e29d06cdf0cc0b650a7215fbb189eb9437112c1b1
Instruction ID: 7f907bf7e636d8497646a16c252ff354b4a681f3e082df62b5565030d069812f
Opcode Fuzzy Hash: fb21ae9a8738533b0d78ff7e29d06cdf0cc0b650a7215fbb189eb9437112c1b1
Instruction Fuzzy Hash: 663166797012049FCB06DF78D49496EBFB2FF89201B4088AAE906CB366DB30DD05CB90

Function 05D487A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e294b267ba01e4b63a6f1191b5e738d72eeea76ffafa46f624de43127299356d
Instruction ID: 7f2600cd20137a48336058229371f2ae4432a2ca2eae0ea7a36856aa853a6d25
Opcode Fuzzy Hash: e294b267ba01e4b63a6f1191b5e738d72eeea76ffafa46f624de43127299356d
Instruction Fuzzy Hash: 9E41F3B1D01248DFDB14DFAAD940ADEFBF6AF88310F14842AE415BB250DB35A945CF91

Function 05D48795 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6338261be17fb3550e074f8c6fa5a3f4b2edb7270b8ace02993933e240def7ec
Instruction ID: 5087732acc1cd816c6fd96b8d7a55f3b48dd9f0e4aafba5034a1ba0c01fdf662
Opcode Fuzzy Hash: 6338261be17fb3550e074f8c6fa5a3f4b2edb7270b8ace02993933e240def7ec
Instruction Fuzzy Hash: 58311FB1D002489BDB14DFAAD980ADEBBF6AF48300F14842AE406BB250DB359945CF91

Function 05D48A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afc27717ea8d6ec7abdaf47a22545d6ca89749f7bc87dbe9f268048fa62ce52
Instruction ID: 5b2c53a55e952625fbcfbf53252379b352498e2a63a5f915f6b70c33bb5da624
Opcode Fuzzy Hash: 4afc27717ea8d6ec7abdaf47a22545d6ca89749f7bc87dbe9f268048fa62ce52
Instruction Fuzzy Hash: D33102B1D01258DFDB14DFA9D880A9EBBF9EF48350F14842AE409B7240CB75A946CF90

Function 0075D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1536355436.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_75d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48b1bee62d98c2c73045deacfbd29850bf937ab57a6e11257cb245c9a9194bd
Instruction ID: 317e43ee3facc9899101c3482564969d08950f34fff82b277e3919ab659bef77
Opcode Fuzzy Hash: a48b1bee62d98c2c73045deacfbd29850bf937ab57a6e11257cb245c9a9194bd
Instruction Fuzzy Hash: CD21F171604244DFDB34DF14D580B56BBA5EB88315F24C569DC0D4B286C3BADC0BCA61

Function 05D48A8C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc01afbdb882d5abd2f10dcb5bf4394a74edc44ae66b284d07378be616c37a91
Instruction ID: 3b06b09310544fa846bb6a61839ac938d253975e38875f7d79ae5efdcb012abf
Opcode Fuzzy Hash: dc01afbdb882d5abd2f10dcb5bf4394a74edc44ae66b284d07378be616c37a91
Instruction Fuzzy Hash: 522110B1D01258DFDB14CFA9C995B9EBBF9AF08350F14842AE409FB240CB749946CF60

Function 0075D005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1536355436.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_75d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b4a39bca6e71eeb00f3cb96efa266b81a2ce321bf83f7f23b4c4008194398b
Instruction ID: 57026dee8aaaeeb4724003de6c4bc59877fe40dfe02dbdceda2ec0944b0108a7
Opcode Fuzzy Hash: 98b4a39bca6e71eeb00f3cb96efa266b81a2ce321bf83f7f23b4c4008194398b
Instruction Fuzzy Hash: 932183755083849FDB12CF24D994B15BF71EB46314F28C5DAD8498F2A7C37A9C0ACB62

Function 05D45698 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4899d475adf1c303c1107591303db5dac12b1a6c345e8a244566c2b82a4a3a60
Instruction ID: c040565e4e817662592e341c05b767cb16617fdfc9bbb475b9194b4b10e24a96
Opcode Fuzzy Hash: 4899d475adf1c303c1107591303db5dac12b1a6c345e8a244566c2b82a4a3a60
Instruction Fuzzy Hash: 6E11C27620C3818FD306DF64F8548867FA1FB52310B4688ABE185CB276DB349849CB54

Function 05D4BC5F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d27159473710e7b7d95ad2817350653d1c0eb3ba7f33c6066cb66ec914cdbf
Instruction ID: bb14d33a3004a4a2c3755f12640caa69780b335232e8c00e51d76febfd1de788
Opcode Fuzzy Hash: a4d27159473710e7b7d95ad2817350653d1c0eb3ba7f33c6066cb66ec914cdbf
Instruction Fuzzy Hash: AA112B312102018FC799A736E99856D3FA3EFC93503048D1CF54B8B651EF747D8A9B92

Function 05D48350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12b229616481822cc3b6626eee14d3ff2238a0253fc4259cd364318db709322
Instruction ID: 1b21eef62e20a35cd32e06f1ddf26e269663bdb7eaa6b33c70b4eed56feafce1
Opcode Fuzzy Hash: f12b229616481822cc3b6626eee14d3ff2238a0253fc4259cd364318db709322
Instruction Fuzzy Hash: 9B01D431B001099FDF14DEA9EC89ABFBBFAFBC4251B144036E604D3240DB30990587E0

Function 05D4C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d03c9c881f15ad91d65335fd32a2ce5c4adef56fd422e9a558db6e0078a84d
Instruction ID: 70fd84fd767ef0047728687737548dd9bed4aaac2b385db7b386d078545851c7
Opcode Fuzzy Hash: e3d03c9c881f15ad91d65335fd32a2ce5c4adef56fd422e9a558db6e0078a84d
Instruction Fuzzy Hash: FA01A5712043018FD3159F75E44969E3BE3EFC9315B10CA29E14B8B685DF78AD0ACB92

Function 05D4BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1d78a7a53200727ec0665b70a9a4e179ff86e62fa20a50b2923c348e50ed99
Instruction ID: 91c6e20989a40cd67ae9a61963e18db8a64beae648269606117cf9aaf9443551
Opcode Fuzzy Hash: 7c1d78a7a53200727ec0665b70a9a4e179ff86e62fa20a50b2923c348e50ed99
Instruction Fuzzy Hash: 2701D8312102018FC698A736E59852D3B93EFC93503448D1CF10B8B650DF747D869B96

Function 0074DAA5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1536311110.000000000074D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_74d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05476a026e8235af31e712c72bc298300fd28697ed4922236e708767900b8c9c
Instruction ID: 6a5314b04cdfd4a91209f54ece83bc9612c774ee0125840df62491564ea16b11
Opcode Fuzzy Hash: 05476a026e8235af31e712c72bc298300fd28697ed4922236e708767900b8c9c
Instruction Fuzzy Hash: 3901A2711083449AE7318A1AC984B67BFA8DF45760F18C95AED494E282C77D9C40CA71

Function 05D454F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b144f9f5c8e08a07d347db43c1b0531edbb58d6e212ddd4614b42348a400c0c9
Instruction ID: 5f20e27c7b1c3fd7962be4edb094195b4e4b14d5a2ed25f8e0e48da5f74bbd15
Opcode Fuzzy Hash: b144f9f5c8e08a07d347db43c1b0531edbb58d6e212ddd4614b42348a400c0c9
Instruction Fuzzy Hash: 9C019E316057858FCB29CE75F94473ABBB3BF84215F18886EE04786A54DA35D484CF40

Function 05D4ACB8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efe16f766cbbf3eeb75b79ebf2814b06505d2e373c5dc472a9e4e188097869b
Instruction ID: 1fde813f94c6e13e2f56ea645865c1c5e9c21b4d2f8478fa63cd45a313d7a6e2
Opcode Fuzzy Hash: 2efe16f766cbbf3eeb75b79ebf2814b06505d2e373c5dc472a9e4e188097869b
Instruction Fuzzy Hash: F2F0AC3A3482519FC7670BA5AC140F97FA6DE87341348489FE282CB211DA584903CBE1

Function 05D4E8B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66048187bf0ecb1fac9bcbe99253817e56523b7e6dd727edc34eda1649f83131
Instruction ID: d2b72707acbd927a05362e80f4f7889538201f0399b67d47d603bcf75f62877b
Opcode Fuzzy Hash: 66048187bf0ecb1fac9bcbe99253817e56523b7e6dd727edc34eda1649f83131
Instruction Fuzzy Hash: 5301D6346083489FCB05DF74D8548593FBAFF8A300B1488AAE545CB262DA36DD01DB91

Function 05D4C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e511b287ab9775a11e43eabff9c31f76126a1cf49077d188c079e40d4d098d9
Instruction ID: c7107bfc134091f0b59c0d0e1e8d708dc4d1abcf0841c3f446a4664d1495c195
Opcode Fuzzy Hash: 7e511b287ab9775a11e43eabff9c31f76126a1cf49077d188c079e40d4d098d9
Instruction Fuzzy Hash: 040144712042058FD314AF79E44C65E7BE3EFC9315B108A29E14B97644DF75AD09CB91

Function 05D48F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b146bc3f8404abb407986d29fa070ab4f251032f41e239dc670d3de4827afd2
Instruction ID: e1b9a47a7d6f160d4fd819a4604493d571efe2864534f0470a60816a43534995
Opcode Fuzzy Hash: 7b146bc3f8404abb407986d29fa070ab4f251032f41e239dc670d3de4827afd2
Instruction Fuzzy Hash: CB01D2B4D0821AEFCB04DFA9D9446AEBBF1FF88301F1084AAD815A3351E7785A41DF91

Function 0074DAA4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1536311110.000000000074D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_74d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ab348094116270fc753e9933f8bf1184652e031bf6ee036fd5556301b88a76
Instruction ID: f7b877ac0e2821c7263c22db0d06b09b54f07e349446d4640492decdf9062d4f
Opcode Fuzzy Hash: 93ab348094116270fc753e9933f8bf1184652e031bf6ee036fd5556301b88a76
Instruction Fuzzy Hash: E5F06272404344AAE7218E16C984B66FFE8EB91774F18C55AED485B286C3799C44CA71

Function 05D4C170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3188023626e852a6993c5f06d5dcee3f45b04938b98322b0476298a5ac315e
Instruction ID: 38d590edb9fb4c7b769efd9b28bdefeb6de75ec537fdd42d2be1f15ee7ada35c
Opcode Fuzzy Hash: ff3188023626e852a6993c5f06d5dcee3f45b04938b98322b0476298a5ac315e
Instruction Fuzzy Hash: B201D176501B018FD319DF26E888452BBF6FF49300700C91EE487C3651DB70A54ACF80

Function 05D4ADE9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60335acf5e5506512d1b5989905d92cd19a5d7cc296dce60f70f8a1b65c2c14
Instruction ID: 316de5c65db316d597b1c9c20a23c16c01df4c4b361a0fb783b58b612aea0842
Opcode Fuzzy Hash: c60335acf5e5506512d1b5989905d92cd19a5d7cc296dce60f70f8a1b65c2c14
Instruction Fuzzy Hash: 1FF0A731245241AFC3696B6AE8586DA7FEADFCF710B10896EF14EC3242CAA528458761

Function 05D48F42 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06399159ac113bf4d89ea5de39076160ce8db9faa236ece166a233dd12f2b64d
Instruction ID: 6bc3c1389b1209fc4c679cb65d036c513b4e24faf5d16557fb88fe3084307736
Opcode Fuzzy Hash: 06399159ac113bf4d89ea5de39076160ce8db9faa236ece166a233dd12f2b64d
Instruction Fuzzy Hash: 0E015AB4D0824ADFCB01DFA4DA446EDBFB1BF49305F10819AD451A7391D7740A40DF91

Function 05D46EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0d2030be2dcd834e6d253bf484151734771ec52173527efc7b980df6fb7505
Instruction ID: f142a0e7703b4fdb87ebb442cb84fba26405cc730a55cfd953575ee5662c9835
Opcode Fuzzy Hash: fa0d2030be2dcd834e6d253bf484151734771ec52173527efc7b980df6fb7505
Instruction Fuzzy Hash: DDF0A7722041E83F8B214E9B5C10CFB3FEDDA8E161B084156FED8C2141C52DC921ABB0

Function 05D46E92 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520fde251952ecce40191f37d551e91eda0e56161083959f044aaec402985dfa
Instruction ID: ad599e30a75a4eb41e323806fdcacd77d4f06f097e79d90afed755bc13ce920e
Opcode Fuzzy Hash: 520fde251952ecce40191f37d551e91eda0e56161083959f044aaec402985dfa
Instruction Fuzzy Hash: 66F0B4762042D82FDB128EA55C109FB3FEDDA8D1227094096FAE4C6251C63CC962AB70

Function 05D4C110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5554a57ac3376b1071631e75b35cc7061fed4f6f789583985c0900b8df396635
Instruction ID: 40d8ffdf1da392a8100de8af8a96fc4202033333a6af078efc93aa4dff9f004b
Opcode Fuzzy Hash: 5554a57ac3376b1071631e75b35cc7061fed4f6f789583985c0900b8df396635
Instruction Fuzzy Hash: EDF0BB312067D04FC312973DF91869E3FE6DF86208B04455AF186CB252DA656D058BA2

Function 05D48FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff8023dadb8d66e673cad2cae54786be8b7e67bf22420458caad8e3c9dc6e46
Instruction ID: 8310a916e237d0c1afd81e5546d2443dd80c3145fdcd33b9c8cbf10dbbe7b6d8
Opcode Fuzzy Hash: cff8023dadb8d66e673cad2cae54786be8b7e67bf22420458caad8e3c9dc6e46
Instruction Fuzzy Hash: 62F049B5D081599FCB01CBA4C8555AEBFB1EF5A241F004197E846E7252E6398A51DF40

Function 05D467C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ef7120f65f56b1d606113103562ef2cf8abc43856ccd3d599435f1c7c38fff
Instruction ID: f3447b5374f3e852b065be9415111d1f9521bc9df59dd85a3b2afc735b0282d0
Opcode Fuzzy Hash: f0ef7120f65f56b1d606113103562ef2cf8abc43856ccd3d599435f1c7c38fff
Instruction Fuzzy Hash: 05F0B871B403008FDB218B64E842F653FE1EB02711F10C66AE2518F1E2E3B1E804DB81

Function 05D45508 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df6247b955406e139d3099edc5ac920493a05ee28c97d24492480da3eecac0c
Instruction ID: 7b817780d877a5b02bf8b78e2b8da7f37c6bb1ce8a47d47971fa30dd1eb68954
Opcode Fuzzy Hash: 8df6247b955406e139d3099edc5ac920493a05ee28c97d24492480da3eecac0c
Instruction Fuzzy Hash: A5F0A030600746CFCB24CE26E900A77B7F7FF80214B04882EE04646914DAB1F485CF80

Function 05D48341 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be856ca69aecd1bf21e28452ab2eb6bdc80c7406bf27bcf904c4a42a622c4e2d
Instruction ID: d5a31819305cc4fd73108a1955bb64c22cfc27539f45600d95261fde10787317
Opcode Fuzzy Hash: be856ca69aecd1bf21e28452ab2eb6bdc80c7406bf27bcf904c4a42a622c4e2d
Instruction Fuzzy Hash: F3F02B32B101158F9F14DAF8AC886BEBBF6BB88291B0C4077D554E3240FF3098068BE1

Function 05D4ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54658b634e3542d88cb9f4cb1da8fcaf09ee23bf2a962d874a6dcbb7ddabbafa
Instruction ID: 1e8adef9a7048d48341923aae9380d26b3bfc98d70d6a76e9d86e4b774c5b366
Opcode Fuzzy Hash: 54658b634e3542d88cb9f4cb1da8fcaf09ee23bf2a962d874a6dcbb7ddabbafa
Instruction Fuzzy Hash: A8E09231340101ABC3282A6AE84CADF7ADBEBCA751B10852DF20EC3242CFA5180547A5

Function 05D4C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6740e1286a7f883925f7258d0fb24d6bf3f4529b165561b496ade2d4a28cac36
Instruction ID: 8b335ba65dbad4700f2ec2f6b9ef7510f8722d1d668cd7f3a40e43a77246d1af
Opcode Fuzzy Hash: 6740e1286a7f883925f7258d0fb24d6bf3f4529b165561b496ade2d4a28cac36
Instruction Fuzzy Hash: D8F06774501B018FE729EF26E48C552BBF6FB88344700C62EE88B82A50DB70A909CF84

Function 05D4B500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0057de52c3c85c3de06fcc65745d9245fbee321da88de215d98949de05004d
Instruction ID: 268e8031049674d50bf302263715e15f7e7222e8e720961ec0a0909ee9518d83
Opcode Fuzzy Hash: 4b0057de52c3c85c3de06fcc65745d9245fbee321da88de215d98949de05004d
Instruction Fuzzy Hash: E3F0C979D0120DBFCB41DFB8E9499CDBFB9EB48204F1082A6E905E3254EA306B55DF91

Function 05D4C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666e598f2f0803405e8506b76dd1f809f868ac30c06c978b1c8459cca03ee926
Instruction ID: 9287211034d6d09d18d21ea33c506d52cf3df367bf437e52a4ed540488f30911
Opcode Fuzzy Hash: 666e598f2f0803405e8506b76dd1f809f868ac30c06c978b1c8459cca03ee926
Instruction Fuzzy Hash: FFE030302007518FC615A73EE54C7AE7BE6DF85318F044929F2468B651DBA578458B91

Function 05D4CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991d1a7185db33ac1bee9f93388e2475d6f416648bb33d6e18ea7dd93b09a875
Instruction ID: 0e5c7e6c5b7ea46c053b93ce397c577fba4c73fb8d056c15c9e788dfedc69663
Opcode Fuzzy Hash: 991d1a7185db33ac1bee9f93388e2475d6f416648bb33d6e18ea7dd93b09a875
Instruction Fuzzy Hash: 30E026332166408FCF56EB25F8C0ADD3B66EB8A720F404253E404CB666CB300C868FD6

Function 05D4CE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a811e223e92f486ecb92b7cf1732dedfb161238bb5b38c5549269ce00f41d57
Instruction ID: 8df66c0d50f44b831bd7d377988cd28f900141b829b23236f8c4794d23483e9a
Opcode Fuzzy Hash: 7a811e223e92f486ecb92b7cf1732dedfb161238bb5b38c5549269ce00f41d57
Instruction Fuzzy Hash: 38E026B1406380EFDB43E320F8C5D953FA9DB06710F014695FC048B66AC7304C828F92

Function 05D4E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18de76b8110ec2fbba2851e0a34aef5a61954c5c7191813d659c419f913be73f
Instruction ID: db176528b9c42a57720e108ae9dfe3bcfcdf2c8ceec0b64959369fe35be38866
Opcode Fuzzy Hash: 18de76b8110ec2fbba2851e0a34aef5a61954c5c7191813d659c419f913be73f
Instruction Fuzzy Hash: B5E0DF71A05204EFCB01DFA4E84499E3BB2DF86204F2042DAF809D7291E6300F108B52

Function 05D4E280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8cf8885f88ee629dfefa1c1f0c263a1c9b0b01625033b8522efb5b56084a0ad
Instruction ID: 45706754ebdac52599a3565bff1d330861f51623a82731970db837bc86479879
Opcode Fuzzy Hash: c8cf8885f88ee629dfefa1c1f0c263a1c9b0b01625033b8522efb5b56084a0ad
Instruction Fuzzy Hash: A3E09A304027409FCB26BB20BEC29953BAAE74AB00F410245EC055B2AAC7641A89CFD6

Function 05D4AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2ada989b5f1674758f4635d6a11e670bbf04533651552d6f236721481af678
Instruction ID: 3253d77064a3c0178b3445da364647c320c670a1798b2a16db5b3e35eb094a2d
Opcode Fuzzy Hash: 6c2ada989b5f1674758f4635d6a11e670bbf04533651552d6f236721481af678
Instruction Fuzzy Hash: 24D05E31340128A78A5D2769F4584FE7BAFEBDA662304992AF70BC7240DF6D1D0287D6

Function 05D4E8F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38454ce3418d6ba8faab7f765ce387b177ab0c3010a5051466ce7c9c3fc14f4c
Instruction ID: 601a49f2f7330ee46d6dfaf886ba49ce9bfb9221d7f3ab337a395e924bb19a92
Opcode Fuzzy Hash: 38454ce3418d6ba8faab7f765ce387b177ab0c3010a5051466ce7c9c3fc14f4c
Instruction Fuzzy Hash: F3E0177A224244AFC7829F54C8818943FB9FF5A61030984C6F6848F273C231E926EB61

Function 05D4B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728fef4cdeab2502a6576a6b55358412f1fe4fafd0f6c32d1cecdb6f463bdae3
Instruction ID: f42122cbe21d44ddd05b9ae72bcd404bb8cb79fa0ef8f63d9d57dafe8999994d
Opcode Fuzzy Hash: 728fef4cdeab2502a6576a6b55358412f1fe4fafd0f6c32d1cecdb6f463bdae3
Instruction Fuzzy Hash: 9AE09A75D0020DEFCB40DFE5E5888DDBBB9EB48200F1082A6D905E3250EB306B55DF80

Function 05D4E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d418642f41966b2832cd0dbf6d8b1284a7805c1fd6d15fc47aa5f600fb545764
Instruction ID: 8ac48d8f470486e605fcbd578843539eaf95fa955063f46f292cd8beb5772612
Opcode Fuzzy Hash: d418642f41966b2832cd0dbf6d8b1284a7805c1fd6d15fc47aa5f600fb545764
Instruction Fuzzy Hash: 3ED017B1A00208FF8B44EFA9E94595DB7BAEB45204B1096A9E909E7200EA312F009B91

Function 05D4F8EA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03718de11e717f69c693240c9572dd4c3cde826dfa196e6c70a9a2d7fa14d82
Instruction ID: c4158cd8726fb6d3626bf2007441f0727771f7d70eb1c6bde9f58132177eb818
Opcode Fuzzy Hash: d03718de11e717f69c693240c9572dd4c3cde826dfa196e6c70a9a2d7fa14d82
Instruction Fuzzy Hash: 50C08C327001208B02D8AA6C701816D77D3C3CC6A338581BFFA0EE3348DEB08D824780

Function 05D4DFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65400481ba6d8fa2aab2f96149561e12b83d6b064dcb465122ebb241c2f5b99f
Instruction ID: 601d622caf876ced06b5ab9bc78888629844eee422fa036448adc9800c7a45ad
Opcode Fuzzy Hash: 65400481ba6d8fa2aab2f96149561e12b83d6b064dcb465122ebb241c2f5b99f
Instruction Fuzzy Hash: EEB09B7154B7D06EDB0247309D0D9453E655F56710B1550C6F7419D0A3D6314005CB91

Non-executed Functions

Function 05D46FE8 Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35f640391b20c5b7175711d120c3911445a28fd8def4f6f3cef29b4f3d9dab8
Instruction ID: 566986f700447e6de8bd3a420570a4c52eecb85f26ec5fcf549e69b6dbd2a6b8
Opcode Fuzzy Hash: f35f640391b20c5b7175711d120c3911445a28fd8def4f6f3cef29b4f3d9dab8
Instruction Fuzzy Hash: 936223B07002009FDB4CDF69D45872A7AE6EB84308F64C95CD10D9F396DBBAD94B8B91

Function 05D46FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8410e0a545f5ddf5dae7a17fa683b563911ed5fa0baba485f0b87c96ba094b9
Instruction ID: d6d7bc347520448d20ead03a66d9804c1d2e14b0ce3c4ad20aefe1b1b4539e8e
Opcode Fuzzy Hash: a8410e0a545f5ddf5dae7a17fa683b563911ed5fa0baba485f0b87c96ba094b9
Instruction Fuzzy Hash: A16222B07002009FDB4CDF69D45872A7AE6EB84308F64C95CD10D9F396DBBAD94B8B91

Function 048DDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1544205376.00000000048D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec6daa41b34985f8fada3d3830bdd11ef3cf765cc6428b2e232ede6d1f00292
Instruction ID: 75a87fe096717da39ed9f50962b9efded9c19f2baffba356ee9480f363b0b460
Opcode Fuzzy Hash: cec6daa41b34985f8fada3d3830bdd11ef3cf765cc6428b2e232ede6d1f00292
Instruction Fuzzy Hash: B9A17032E012058FCF05DFB9C84059EB7F2FF84304B258A6AE906EB255DB75E945DB80

Function 0722F483 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b5a64961d1111e5f0c60451c6f72183c5054cc45ff8d119c5f1212722ade1f
Instruction ID: 88c5eb0db9c280a562e7bece6904ffe47fca7f651fc506b984706d4b5edf5734
Opcode Fuzzy Hash: 80b5a64961d1111e5f0c60451c6f72183c5054cc45ff8d119c5f1212722ade1f
Instruction Fuzzy Hash: 9CC1B174E01218CFDB58DFA9D990A9DBBB2FF89300F1085AAD409AB355DB349E46CF41

Function 0722F490 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1549736534.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df87804efaba3ec4659de1d656b7318883c011cca067233bbd9181b070ce03dd
Instruction ID: dd791ad55c0eecffed78fba58cf9a677a8d1cf632fcda8c40c32931496124d52
Opcode Fuzzy Hash: df87804efaba3ec4659de1d656b7318883c011cca067233bbd9181b070ce03dd
Instruction Fuzzy Hash: ACC1B174E01218CFDB58DFA9D990B9DBBB2BF89300F1085AAD409AB355DB349D46CF41

Function 05D4ED10 Relevance: 7.9, Strings: 6, Instructions: 377COMMON

Download Yara Rule

Strings

(__q, xrefs: 05D4ED7A
(__q, xrefs: 05D4EF79
(__q, xrefs: 05D4F0F9
(__q, xrefs: 05D4F07A
(__q, xrefs: 05D4EEFA
(__q, xrefs: 05D4EDF9

Memory Dump Source

Source File: 00000005.00000002.1545682229.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5d40000_file.jbxd

Similarity

API ID:
String ID: (__q$(__q$(__q$(__q$(__q$(__q
API String ID: 0-1985298857
Opcode ID: 60e739f4227a8fe3d78e3064246a9ab69384b9b161d71b6b743c7cedd4392b08
Instruction ID: c49e8308dc313cff58aa385334ded77b66bef179921d7fb74638b3629cccdabc
Opcode Fuzzy Hash: 60e739f4227a8fe3d78e3064246a9ab69384b9b161d71b6b743c7cedd4392b08
Instruction Fuzzy Hash: 37D1EF34B04344AFCB149F68D4585AE7BB6FF86300F64856AE80ADB391DB359E02CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Tmp49EB.tmp

C:\Users\user\AppData\Local\Temp\Tmp49EC.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 0722B380 Relevance: 17.9, Strings: 14, Instructions: 384
COMMON

Function 07221BD0 Relevance: 6.6, Strings: 5, Instructions: 394
COMMON

Function 0722F9F0 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Function 0722B828 Relevance: 4.3, Strings: 3, Instructions: 506
COMMON

Function 07220040 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Function 05D30D80 Relevance: 20.6, Strings: 16, Instructions: 617
COMMON

Function 05D31582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Function 048DAE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Function 05D31291 Relevance: 2.6, Strings: 2, Instructions: 131
COMMON